Tautulli

Records20All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical2CVSS 9.0–10.0

CVSS high10CVSS 7.0–8.9

Exploited now

Tautulli records in CISA KEV

No Tautulli vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Tautulli 11 records HIGH

Records

20 records

TI-2026-29704 CVE-2026-41065

Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory

HIGH 80

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 4.0HIGH 8.9 Network No auth No interaction EPSS 0.00434 Published 2026-06-04 Fixed in 2.17.1 CWE-1336

TI-2026-24384 CVE-2026-31831

Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint

HIGH 77

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.01965 Published 2026-03-30 Fixed in 2.17.0 CWE-23

TI-2026-32030 CVE-2026-43986

Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay

HIGH 76

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00262 Published 2026-06-04 Fixed in 2.17.1 CWE-918

TI-2025-36419 CVE-2025-58761

Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`

HIGH 76

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00684 Published 2025-09-09 Fixed in 2.16.0 CWE-27

TI-2026-32028 CVE-2026-43984

Tautulli has stored XSS in logFile via guest-controlled log_js_errors input

HIGH 74

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.00207 Published 2026-06-04 Fixed in 2.17.1 CWE-79

TI-2026-32029 CVE-2026-43985

Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover

HIGH 73

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00146 Published 2026-06-04 Fixed in 2.17.1 CWE-352

TI-2025-36418 CVE-2025-58760

Tautulli vulnerable to Unauthenticated Path Traversal in `/image` endpoint

HIGH 70

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0064 Published 2025-09-09 Fixed in 2.16.0 CWE-23

TI-2026-22767 CVE-2026-28505

Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check

HIGH 68

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 4.0HIGH 7.5 Network High privileges No interaction EPSS 0.00494 Published 2026-03-30 Fixed in 2.17.0 CWE-94

TI-2026-37943 CVE-2026-52835

Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database

MEDIUM 64

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 4.0HIGH 7.0 Network High privileges No interaction EPSS 0.00591 Published 2026-09-21 Fixed in 2.17.2 CWE-22

TI-2026-29341 CVE-2026-40605

Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API

MEDIUM 59

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 4.0MEDIUM 5.7 Network Low privileges No interaction EPSS 0.00303 Published 2026-06-04 Fixed in 2.17.1 CWE-22

TI-2026-39684 CVE-2026-54915

Tautulli: Open redirect via whitespace bypass in /auth/redirect

MEDIUM 58

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00257 Published 2026-09-21 Fixed in 2.17.2 CWE-601

TI-2026-33171 CVE-2026-45381

Tautulli: Reflected XSS in `/search` endpoint

MEDIUM 56

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 4.0MEDIUM 5.1 Network No auth User interaction EPSS 0.0057 Published 2026-09-21 Fixed in 2.17.2 CWE-79

TI-2026-24354 CVE-2026-31799

Tautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters

MEDIUM 56

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 3.1MEDIUM 4.9 Network High privileges No interaction EPSS 0.00415 Published 2026-03-30 Fixed in 2.17.0 CWE-20

TI-2026-36826 CVE-2026-49995

Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter

MEDIUM 55

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00602 Published 2026-09-21 Fixed in 2.17.2 CWE-79

TI-2019-14295 CVE-2019-19833 · GHSA-cqvv-6jhx-qvwf

In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote…

MEDIUM 44

In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.14706 Published 2019-12-18 No fix listed CWE-352

TI-2025-36421 CVE-2025-58763

Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection

MEDIUM 41

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 3.1HIGH 8.1 Network High privileges No interaction EPSS 0.01675 Published 2025-09-09 Fixed in 2.16.0 CWE-78

TI-2025-36420 CVE-2025-58762

Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent

MEDIUM 41

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.0082 Published 2025-09-09 Fixed in 2.16.0 CWE-73

TI-2026-24804 CVE-2026-32275

Tautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theft

MEDIUM 40

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 4.0HIGH 7.4 Network No auth User interaction EPSS 0.00354 Published 2026-03-30 Fixed in 2.17.0 CWE-79

TI-2019-06451 CVE-2019-8939 · GHSA-7gxp-888w-8h8j

data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex…

LOW 29

data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.0109 Published 2019-02-19 No fix listed CWE-79

TI-2026-24359 CVE-2026-31804

Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server

LOW 24

Tautulli is a Python based monitoring and tracking tool for Plex Media Server.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00282 Published 2026-03-30 Fixed in 2.17.0 CWE-918

Open these records in search →