Index
Search
Search the public record. Drafts and scheduled notes are not included.
threats
Plex2Shell chain (CVE-2026-96652, -96654, -96655, -96656) has a public PoC and one honeypot hit
Four Plex Media Server CVEs form the Plex2Shell chain, which a researcher says gives unauthenticated remote code execution. A public repository covers it. One researcher saw the published code used against a honeypot on 17 October 2026 and a cryptominer dropped. Fixed in 1.43.3.10861. Not in CISA KEV as of check.
Published 4h ago
research
XRPL payment engine overflow could have minted XRP
XRPL disclosed a critical integer overflow in the XRP Ledger payment engine, present since the 2015 rewrite. Crafted offers plus one payment could have created spendable XRP beyond the 100 billion supply cap. Veria Labs says its AI found it; RippleX shipped xrpld 3.4.1 in three days. No mainnet exploitation found. No CVE.
Published 7d ago
CVE-2026-107406
NetScaler SAML memory overflow leading to RCE or denial of service
RCE
Published 10d ago
CVE-2026-96652
Plex Media Server SSRF in /player/timeline
SSRF
Published 23 Sept 2026
CVE-2026-96654
Plex Media Server searchOne URL handling lets callers reach other plugin functions
Other
Published 23 Sept 2026
CVE-2026-96655
Plex Media Server transcoder path parameter allows requests to arbitrary addresses
SSRF
Published 23 Sept 2026
CVE-2026-96656
Plex Media Server admin file write runs as code when the transcoder starts
RCE
Published 23 Sept 2026