Access Control

Every one of the 6 is a mark on the map. Named now: 1 to 6, most at risk first.

1. Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service.CVE-2021-33959Plex · CVSS 7.5 · 15% likely

   CWE-346

2. Plex Media Server before 0.9.9.3 allows remote attackers to bypass the web server whitelist, conduct SSRF attacks, and execute arbitrary administrative actions via multiple crafte…CVE-2014-9304Plex · 8.1% likely

   CWE-264

3. Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the…CVE-2025-34158Plex · CVSS 8.5 · 0.6% likelycovered by CyberSIXT

   CWE-6691 article

4. In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve share tokens (intended for unrelated access) via a shared_servers end…CVE-2025-69417Plex · CVSS 5 · 0.3% likely

   CWE-863

5. In the plex.tv backend for Plex Media Server (PMS) through 2025-12-31, a non-server device token can retrieve other tokens (intended for unrelated access) via clients.plex.tv/devi…CVE-2025-69416Plex · CVSS 5 · 0.3% likely

   CWE-863

6. Plex Media Server (PMS) through 1.42.2.10156 allows retrieval of a permanent access token via a /myplex/account call with a transient access token.CVE-2025-69414Plex · CVSS 8.5 · 0.3% likely

   CWE-863

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.