TI-2026-24384 CVE-2026-31831
Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint
Priority HIGH 77
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
Tautulli
Records20All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high10CVSS 7.0–8.9
Exploited now
Tautulli records in CISA KEVNo Tautulli vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
11 records in Tautulli · all components
TI-2025-36419 CVE-2025-58761
Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`
Priority HIGH 76
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2025-36418 CVE-2025-58760
Tautulli vulnerable to Unauthenticated Path Traversal in `/image` endpoint
Priority HIGH 70
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-22767 CVE-2026-28505
Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check
Priority HIGH 68
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-24354 CVE-2026-31799
Tautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters
Priority MEDIUM 56
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2019-14295 CVE-2019-19833 · GHSA-cqvv-6jhx-qvwf
In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote…
Priority MEDIUM 44
In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server.
TI-2025-36421 CVE-2025-58763
Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection
Priority MEDIUM 41
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2025-36420 CVE-2025-58762
Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent
Priority MEDIUM 41
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-24804 CVE-2026-32275
Tautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theft
Priority MEDIUM 40
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2019-06451 CVE-2019-8939 · GHSA-7gxp-888w-8h8j
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex…
Priority LOW 29
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page.
TI-2026-24359 CVE-2026-31804
Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server
Priority LOW 24
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.