Tautulli

Tautulli

11 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
9.1

CVE-2026-32275

Exploit
  • EPSS 0.06%
  • Veröffentlicht 30.03.2026 19:43:06
  • Zuletzt bearbeitet 02.04.2026 15:38:25

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before version 2.17.0, an unsanitized JSONP callback parameter allows cross-origin script injection and API key theft. This issue has been patched i...

4.9

CVE-2026-31799

Exploit
  • EPSS 0.03%
  • Veröffentlicht 30.03.2026 19:42:56
  • Zuletzt bearbeitet 02.04.2026 16:40:46

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.17.0 for parameters "before" and "after" and from version 2.1.0-beta to before version 2.17.0 for parameters "section_id" and "user...

7.5

CVE-2026-31831

Exploit
  • EPSS 0.08%
  • Veröffentlicht 30.03.2026 19:42:23
  • Zuletzt bearbeitet 02.04.2026 15:42:45

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the app...

5.3

CVE-2026-31804

Exploit
  • EPSS 0.05%
  • Veröffentlicht 30.03.2026 19:42:09
  • Zuletzt bearbeitet 14.04.2026 01:43:40

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pms_image_proxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without ...

10

CVE-2026-28505

Exploit
  • EPSS 0.03%
  • Veröffentlicht 30.03.2026 19:41:54
  • Zuletzt bearbeitet 02.04.2026 16:55:37

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() function in notification_handler.py implements a sandboxed eval() for notification text templates. The sandbox attempts to restrict...

7.2

CVE-2025-58763

Exploit
  • EPSS 0.48%
  • Veröffentlicht 09.09.2025 20:13:44
  • Zuletzt bearbeitet 18.09.2025 20:30:01

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. A command injection vulnerability in Tautulli v2.15.3 and prior allows attackers with administrative privileges to obtain remote code execution on the application server. ...

7.2

CVE-2025-58762

Exploit
  • EPSS 0.77%
  • Veröffentlicht 09.09.2025 20:08:27
  • Zuletzt bearbeitet 18.09.2025 16:57:38

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. In Tautulli v2.15.3 and earlier, an attacker with administrative access can use the `pms_image_proxy` endpoint to write arbitrary python scripts into the application files...

7.5

CVE-2025-58761

Exploit
  • EPSS 0.14%
  • Veröffentlicht 09.09.2025 19:59:17
  • Zuletzt bearbeitet 18.09.2025 17:23:40

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `real_pms_image_proxy` endpoint in Tautulli v2.15.3 and prior is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the appl...

7.5

CVE-2025-58760

Exploit
  • EPSS 0.18%
  • Veröffentlicht 09.09.2025 19:56:57
  • Zuletzt bearbeitet 18.09.2025 17:30:18

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. The `/image` API endpoint in Tautulli v2.15.3 and earlier is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application ...

6.5

CVE-2019-19833

Exploit
  • EPSS 61.27%
  • Veröffentlicht 18.12.2019 18:15:20
  • Zuletzt bearbeitet 21.11.2024 04:35:29

In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media server. (Also, anonymous access can be achieved in applications that do not have a user login area).