Four Plex Media Server flaws and what their CVSS vectors say about patch order

Plex Media Server before 1.43.3.10861 is affected by a set of four related flaws that the CNA published separately: CVE-2026-96652, CVE-2026-96654, CVE-2026-96655 and CVE-2026-96656. The identifiers are not four copies of one bug. Each record names a different endpoint or subsystem and each carries its own severity, which gives administrators a defensible order for patching even when all four share a single fixed version.

Vulnerability overview

CVE-2026-96652 is a SSRF in the timeline handler with CVSS v3.1 score 4.3. CVE-2026-96654 is a URL injection problem in searchOne with score 6.5 and CWE-84. CVE-2026-96655 is an arbitrary-host SSRF through the /video/:/transcode/universal path parameter with score 4.3.…