Spremljamo ranljivosti v izdelkih največjih proizvajalcev, kot so Microsoft, Cisco, Fortinet, Citrix in drugi. Izberite proizvajalca za seznam njegovih aktivnih ranljivosti in naših člankov.
Plex: ranljivosti v zadnjem letu
| CVE | CVSS | EPSS | CISA KEV | Proizvajalec | Opis (NVD, angleško) |
|---|---|---|---|---|---|
| CVE-2026-96656 | 8,6 Visoko | 1,8 % | Aktivno izkoriščana od 20. 10. 2026 | Plex | Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options is appended verbatim to x264's option string on every transcode. At startup, all .so files are run without si |
| CVE-2026-96654 | 6,9 Srednje | 1,9 % | Aktivno izkoriščana od 20. 10. 2026 | Plex | Plex Media Server before 1.43.3.10861 does not correctly neutralize URL values included in 'searchOne,' allowing an attacker to call other plugins' functions and supply their own parameters. |
| CVE-2026-96652 | 5,3 Srednje | 1,8 % | Aktivno izkoriščana od 20. 10. 2026 | Plex | Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'protocol' parameter and force the Plex server to POST to the attacker's chosen destination. |
| CVE-2026-96655 | 5,3 Srednje | 1,6 % | Aktivno izkoriščana od 20. 10. 2026 | Plex | Plex Media Server before 1.43.3.10861 allows an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. |
Naši članki: Plex
Plex2Shell: veriga štirih ranljivosti v Plex Media Server izkoriščena v praksi
Raziskovalec je razkril verigo štirih ranljivosti v Plex Media Server, poimenovano Plex2Shell, ki omogoča izvajanje kode brez prijave. Po navedbah virov so napadalci v nekaj urah po objavi…
Conquering the Complexities of Modern BCDR
The modern business landscape is both thrilling and daunting. With rapidly evolving technology, persistent cyber threats, and increasing operational complexities, data protection and seamless business continuity...
Acronym Overdose – Navigating the Complex Data Security Landscape
Understanding Data Security Acronyms In modern enterprises, data security is often discussed using a complex lexicon of acronyms—DLP, DDR, DSPM, and many others. While these acronyms...
Kampanja GhostAction ogrozila okoli 1.900 računov GitHub in ciljala na več kot 30.000 repozitorijev
Kampanja kraje poverilnic z imenom GhostAction je po navedbah GitGuardian ogrozila okoli 1.900 računov GitHub in ciljala na več kot 30.000 repozitorijev, povezanih s 3.000 uporabniki in organizacijami.…
Vtičnik Rank Math PRO za WordPress ogrožen v napadu na dobavno verigo
Napadalci so v različico 3.0.123 vtičnika Rank Math PRO vrinili zlonamerno kodo, ki je bila prek uradne strani rankmath.com in sistema posodobitev na voljo med 15. in 16.…
Lažni Web3 pospeševalnik Apex širil zlonamerne npm pakete med ustanovitelje kripto podjetij
Po navedbah virov je lažni Web3 pospeševalnik z imenom Apex prek dveh zlonamernih npm paketov ciljal ustanovitelje kriptovalutnih podjetij in na njihove sisteme Windows in macOS nameščal infostealerje…
Summary of Vulnerability and Protection Measures against AutomationDirect C-more EA9 HMI Vulnerabilities
CVE-2025-0960 is a critical vulnerability impacting the AutomationDirect C-more EA9 HMI. Identified on January 31, 2025, this vulnerability represents a “Classic Buffer Overflow” (CWE-120) and can...
Summary of CVE-2025-24968: Vulnerability in reNgine Framework Leading to Remote Command Execution
A critical vulnerability, known as CVE-2025-24968, has recently emerged in the reNgine Project. This vulnerability allows remote command execution, posing a severe threat to users relying...
Vulnerability Overview – CVE-2025-24891: Dumb Drop Root File Overwrite Vulnerability
The recent discovery of CVE-2025-24891, also known as the “Dumb Drop Root File Overwrite Vulnerability,” has raised significant alarms among tech experts. This critical vulnerability was...