TTautulli

Products

Exploited and recent CVEs

• CVE-2026-45381 Medium 5.1 Tautulli: Reflected XSS in `/search` endpoint 0.6%
• CVE-2026-49995 Medium 4.8 Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter 0.6%
• CVE-2026-54915 Medium 5.4 Tautulli: Open redirect via whitespace bypass in /auth/redirect 0.3%
• CVE-2026-52835 High 7.0 Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database 0.6%
• CVE-2026-43986 Critical 9.9 Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay 0.3%
• CVE-2026-43985 High 8.8 Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover 0.1%
• CVE-2026-43984 High 8.9 Tautulli has stored XSS in logFile via guest-controlled log_js_errors input 0.2%
• CVE-2026-41065 High 8.9 Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory 0.4%
• CVE-2026-40605 Medium 5.7 Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API 0.3%
• CVE-2026-32275 Critical 9.1 Tautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theft 0.4%
• CVE-2026-31799 Medium 4.9 Tautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters 0.4%
• CVE-2026-31831 High 8.7 Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint 2.0%
• CVE-2026-31804 Medium 4.0 Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server 0.3%
• CVE-2026-28505 High 7.5 Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check 0.5%
• CVE-2025-58763 High 8.1 Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection 1.7%
• CVE-2025-58762 Critical 9.1 Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent 0.8%
• CVE-2025-58761 High 8.6 Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy` 0.7%
• CVE-2025-58760 High 8.6 Tautulli vulnerable to Unauthenticated Path Traversal in `/image` endpoint 0.6%