TI-2026-24804 CVE-2026-32275
Tautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theft
Priority MEDIUM 40
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
Vulnerabilities
11 records
TI-2026-24354 CVE-2026-31799
Tautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters
Priority MEDIUM 56
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-24384 CVE-2026-31831
Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint
Priority HIGH 77
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-24359 CVE-2026-31804
Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server
Priority LOW 24
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-22767 CVE-2026-28505
Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check
Priority HIGH 68
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2025-36421 CVE-2025-58763
Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection
Priority MEDIUM 41
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2025-36420 CVE-2025-58762
Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent
Priority MEDIUM 41
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2025-36419 CVE-2025-58761
Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`
Priority HIGH 76
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2025-36418 CVE-2025-58760
Tautulli vulnerable to Unauthenticated Path Traversal in `/image` endpoint
Priority HIGH 70
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2019-14295 CVE-2019-19833 · GHSA-cqvv-6jhx-qvwf
In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote…
Priority MEDIUM 44
In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server.
TI-2019-06451 CVE-2019-8939 · GHSA-7gxp-888w-8h8j
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex…
Priority LOW 29
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page.