Tautulli vulnerabilities

Products

• Tautulli 20

Newest

• tautulli Tautulli: Reflected XSS in `/search` endpoint CVE-2026-45381 5.1 MediumSeptember 21, 2026
• tautulli Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter CVE-2026-49995 4.8 MediumSeptember 21, 2026
• tautulli Tautulli: Open redirect via whitespace bypass in /auth/redirect CVE-2026-54915 5.4 MediumSeptember 21, 2026
• tautulli Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database CVE-2026-52835 7.0 HighSeptember 21, 2026
• tautulli Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay CVE-2026-43986 9.9 CriticalJune 4, 2026
• tautulli Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover CVE-2026-43985 8.8 HighJune 4, 2026
• tautulli Tautulli has stored XSS in logFile via guest-controlled log_js_errors input CVE-2026-43984 8.9 HighJune 4, 2026
• tautulli Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory CVE-2026-41065 8.9 HighJune 4, 2026
• tautulli Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API CVE-2026-40605 5.7 MediumJune 4, 2026
• tautulli Tautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theft CVE-2026-32275 7.4 HighMarch 30, 2026
• tautulli Tautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters CVE-2026-31799 4.9 MediumMarch 30, 2026
• tautulli Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint CVE-2026-31831 8.7 HighMarch 30, 2026
• tautulli Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server CVE-2026-31804 4.0 MediumMarch 30, 2026
• tautulli Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check CVE-2026-28505 7.5 HighMarch 30, 2026
• tautulli Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection CVE-2025-58763 8.1 HighSeptember 9, 2025
• tautulli Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent CVE-2025-58762 9.1 CriticalSeptember 9, 2025
• tautulli Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy` CVE-2025-58761 8.6 HighSeptember 9, 2025
• tautulli Tautulli vulnerable to Unauthenticated Path Traversal in `/image` endpoint CVE-2025-58760 8.6 HighSeptember 9, 2025
• tautulli In Tautulli 2.1.9, CSRF in the /shutdown URI allows an attacker to shut down the remote media... CVE-2019-19833 EPSS 14.7% 6.5 MediumDecember 18, 2019
• tautulli data/interfaces/default/history.html in Tautulli 2.1.26 has XSS via a crafted Plex username that... CVE-2019-8939 6.1 MediumFebruary 19, 2019