{
  "id": "CVE-2026-96655",
  "vendor_project": "Plex",
  "product": "Media Server",
  "description": "Plex Media Server contains a server-side request forgery (SSRF) vulnerability that could allow an authenticated user to request arbitrary internal or external addresses via the '/video/:/transcode/universal' path parameter. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96654, and CVE-2026-96656.",
  "kev_date_added": "2026-10-20",
  "cvss": 9.0,
  "severity": "High",
  "advisories": [],
  "cited_in_cases": [],
  "indictment_cited": false
}