{
  "id": "CVE-2026-96654",
  "vendor_project": "Plex",
  "product": "Media Server",
  "description": "Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.",
  "kev_date_added": "2026-10-20",
  "cvss": 9.0,
  "severity": "High",
  "advisories": [],
  "cited_in_cases": [],
  "indictment_cited": false
}