[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fffJSyMptMTJx7ctbsm3VL8ucrXG9cCgo5iH610iA0as":3,"g5a-risk:CVE-2026-96654":135},{"success":4,"data":5,"meta":132},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":38,"epssPercentile":28,"epssTimeSeries":39,"severity":41,"affectedProducts":42,"affectedProductsCount":48,"references":49,"referencesCount":69,"weaknesses":70,"weaknessesCount":48,"isActivelyExploited":4,"cisaInfo":79,"otxData":28,"relatedBlogPosts":80,"seoMetadata":81,"configurations":106,"relatedVendorCves":116,"notableEvents":117},"CVE-2026-96654","What is CVE-2026-96654?","Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters.","Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions...","2026-09-23T17:17:23.517","2026-09-29T18:35:57.403",6.9,"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:N\u002FUI:N\u002FVC:L\u002FVI:L\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",{"CVSSMetricV31":15,"CVSSMetricV30":31,"CVSSMetricV2":32,"CVSSMetricV40":33},[16],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":29,"ImpactScore":30},"9119a7d8-5eab-497f-8521-727c672e3725","Secondary",{"Version":20,"VectorString":21,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":24,"Scope":25,"ConfidentialityImpact":23,"IntegrityImpact":23,"AvailabilityImpact":24,"BaseScore":26,"BaseSeverity":27,"ExploitCodeMaturity":28,"RemediationLevel":28,"ReportConfidence":28,"TemporalScore":28,"TemporalSeverity":28,"ConfidentialityRequirement":28,"IntegrityRequirement":28,"AvailabilityRequirement":28,"ModifiedAttackVector":28,"ModifiedAttackComplexity":28,"ModifiedPrivilegesRequired":28,"ModifiedUserInteraction":28,"ModifiedScope":28,"ModifiedConfidentialityImpact":28,"ModifiedIntegrityImpact":28,"ModifiedAvailabilityImpact":28,"EnvironmentalScore":28,"EnvironmentalSeverity":28},"3.1","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:L\u002FI:L\u002FA:N","NETWORK","LOW","NONE","UNCHANGED",6.5,"MEDIUM",null,3.9,2.5,[],[],[34],{"Source":17,"Type":18,"CVSSData":35},{"Version":36,"VectorString":13,"BaseScore":12,"BaseSeverity":27,"AttackVector":22,"AttackComplexity":23,"AttackRequirements":24,"PrivilegesRequired":24,"UserInteraction":24,"VulnConfidentialityImpact":23,"VulnIntegrityImpact":23,"VulnAvailabilityImpact":24,"SubConfidentialityImpact":24,"SubIntegrityImpact":24,"SubAvailabilityImpact":24,"ExploitMaturity":37,"ConfidentialityRequirement":37,"IntegrityRequirement":37,"AvailabilityRequirement":37,"ModifiedAttackVector":37,"ModifiedAttackComplexity":37,"ModifiedAttackRequirements":37,"ModifiedPrivilegesRequired":37,"ModifiedUserInteraction":37,"ModifiedVulnConfidentialityImpact":37,"ModifiedVulnIntegrityImpact":37,"ModifiedVulnAvailabilityImpact":37,"ModifiedSubConfidentialityImpact":37,"ModifiedSubIntegrityImpact":37,"ModifiedSubAvailabilityImpact":37,"Safety":37,"Automatable":37,"Recovery":37,"ValueDensity":37,"VulnerabilityResponseEffort":37,"ProviderUrgency":37},"4.0","NOT_DEFINED",0.01949,[40,40,38,38,38,38,38],0.00465,"Medium",[43],{"vendor":44,"product":45,"version":46,"criteria":47,"vulnerable":4},"plex","media_server","*","cpe:2.3:a:plex:media_server:*:*:*:*:*:*:*:*",1,[50,55,60,65],{"url":51,"source":52,"tags":53},"https:\u002F\u002Fforums.plex.tv\u002Ft\u002Fplex-media-server\u002F30447\u002F711","Plex",[54],"Release Notes",{"url":56,"source":57,"tags":58},"https:\u002F\u002Fraw.githubusercontent.com\u002Fcisagov\u002FCSAF\u002Fdevelop\u002Fcsaf_files\u002FIT\u002Fwhite\u002F2026\u002Fva-26-266-01.json","Githubusercontent",[59],"Third Party Advisory",{"url":61,"source":62,"tags":63},"https:\u002F\u002Fwww.cve.org\u002FCVERecord?id=CVE-2026-96654","Cve",[59,64],"VDB Entry",{"url":66,"source":67,"tags":68},"https:\u002F\u002Fzmain.info\u002Fblog\u002Fplex2shell","Zmain",[59],4,[71],{"id":72,"name":73,"description":74,"extendedDescription":75,"status":76,"abstraction":77,"structure":78},"CWE-84","Improper Neutralization of Encoded URI Schemes in a Web Page","The web application improperly neutralizes user-controlled input for executable script disguised with URI encodings.","","Draft","Variant","Simple",{"shortDescription":75,"requiredAction":75,"vulnerabilityName":75,"dateAdded":28},[],{"title":82,"metaDescription":83,"keywords":84,"canonicalUrl":85,"structuredData":86},"What is CVE-2026-96654? Vulnerability Analysis | Security Advisory | EdgeProtect","Comprehensive analysis of CVE-2026-96654, a medium severity cyber security vulnerability from 2026. Plex Media Server before 1.43.3.10861 does not correctly ...","CVE-2026-96654, CVE-2026-96654 vulnerability, CVE-2026-96654 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2026, CVSS score, exploit, patch, remediation, plex security, media_server vulnerability","\u002Fwhat-is\u002Fcve-2026-96654",{"@context":87,"@type":88,"headline":82,"description":83,"datePublished":10,"dateModified":11,"author":89,"publisher":93,"about":97,"mainEntityOfPage":101,"articleSection":104,"keywords":105},"https:\u002F\u002Fschema.org","TechArticle",{"@type":90,"name":91,"url":92},"Organization","EdgeProtect","https:\u002F\u002Fedgeprotect.io",{"@type":90,"name":91,"url":92,"logo":94},{"@type":95,"url":96},"ImageObject","https:\u002F\u002Fedgeprotect.io\u002Fimg\u002Flogos\u002Fedgeprotect-logo-512.png",{"@type":98,"name":6,"description":99,"additionalType":100},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":102,"@id":103},"WebPage","https:\u002F\u002Fedgeprotect.io\u002Fwhat-is\u002Fcve-2026-96654","Cybersecurity","CVE-2026-96654, CVE-2026-96654 vulnerability, CVE-2026-96654 security, medium severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[107],{"Operator":28,"Negate":28,"Nodes":108},[109],{"Operator":110,"Negate":111,"CPEMatch":112},"OR",false,[113],{"Vulnerable":4,"Criteria":47,"MatchCriteriaID":114,"VersionStartExcluding":28,"VersionStartIncluding":28,"VersionEndExcluding":115,"VersionEndIncluding":28},"48C79D09-D197-4165-B027-8BCCE6CD4861","1.43.0.10861",[],[118,125],{"id":119,"eventType":120,"eventTime":121,"details":122,"label":123,"color":124},"a1ccb264-5c1c-4e58-ad10-a4433100b1d5","NEW_NVD","2026-09-24T04:01:41.109086+00:00","New CVE added to NVD","Published to NVD","blue",{"id":126,"eventType":127,"eventTime":128,"details":129,"label":130,"color":131},"700fc9c8-a5de-40ed-a6c2-39726d2cdf40","NEW_CISA","2026-10-21T04:01:11.765113+00:00","CVE added to CISA Known Exploited Vulnerabilities","Added to CISA KEV","red",{"lastModified":11,"cacheTime":133,"version":134},1793384868263,"2.0",{"score":136,"band":137,"action":138,"scoredAt":139},74,"High","Emergency patch","2026-10-30T07:21:37.76942+00:00"]