TI-2026-33171 CVE-2026-45381
Tautulli: Reflected XSS in `/search` endpoint
Priority MEDIUM 56
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
Vulnerabilities
20 records
Priority MEDIUM 55
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
Priority MEDIUM 58
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-37943 CVE-2026-52835
Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database
Priority MEDIUM 64
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-32030 CVE-2026-43986
Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay
Priority HIGH 76
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-32029 CVE-2026-43985
Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover
Priority HIGH 73
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-32028 CVE-2026-43984
Tautulli has stored XSS in logFile via guest-controlled log_js_errors input
Priority HIGH 74
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-29704 CVE-2026-41065
Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory
Priority HIGH 80
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-29341 CVE-2026-40605
Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API
Priority MEDIUM 59
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-24804 CVE-2026-32275
Tautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theft
Priority MEDIUM 40
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-24354 CVE-2026-31799
Tautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters
Priority MEDIUM 56
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-24384 CVE-2026-31831
Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint
Priority HIGH 77
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-24359 CVE-2026-31804
Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server
Priority LOW 24
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2026-22767 CVE-2026-28505
Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check
Priority HIGH 68
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2025-36421 CVE-2025-58763
Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection
Priority MEDIUM 41
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2025-36420 CVE-2025-58762
Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent
Priority MEDIUM 41
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2025-36419 CVE-2025-58761
Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy`
Priority HIGH 76
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2025-36418 CVE-2025-58760
Tautulli vulnerable to Unauthenticated Path Traversal in `/image` endpoint
Priority HIGH 70
Tautulli is a Python based monitoring and tracking tool for Plex Media Server.
TI-2019-14295 CVE-2019-19833 · GHSA-cqvv-6jhx-qvwf
In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote…
Priority MEDIUM 44
In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server.
TI-2019-06451 CVE-2019-8939 · GHSA-7gxp-888w-8h8j
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex…
Priority LOW 29
data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that is mishandled when constructing the History page.