Vulnerability intelligence

CVE-2026-81376 is a security feature bypass vulnerability affecting Microsoft Visual Studio Code versions 1.0.0 through 1.136.1. The flaw stems from an incomplete comparison operation within the application's security evaluation logic, which is categorized as a protection mechanism failure. When Visual Studio Code assesses a security decision, the comparison logic omits certain necessary factors. An attacker can exploit this by crafting input that satisfies the partial check while violating the omitted factors, allowing them to bypass the editor's built-in security controls. Exploitation of this vulnerability requires user interaction, such as opening a repository, workspace, or file supplied by the attacker. Once triggered over a network, the bypass can lead to a scope change, enabling the compromised component to affect resources outside its intended security boundary. This can result in behaviors such as the unexpected launching of command shells, scripting interpreters, or network utilities, as well as unauthorized modifications to configuration files within the workspace. Microsoft has addressed this issue in Visual Studio Code version 1.136.2.

CVE-2025-29009 is an unauthenticated arbitrary file upload vulnerability affecting the Webkul Medical Prescription Attachment Plugin for WooCommerce, a WordPress plugin, in all versions up to and including 1.2.3. The vulnerability is caused by a lack of server-side validation for file extensions or MIME types within the plugin's `wkwcpa_handle_prescription_session` AJAX handler. Because the handler accepts file uploads via the `wkwc_pa_prescription_attachment[]` parameter without verifying the file type, it allows users to upload arbitrary files to the server. To exploit this vulnerability, an unauthenticated attacker can retrieve the necessary `ajaxNonce` from the public WooCommerce storefront, where it is embedded in the `wkwcpaFrontObj` JavaScript object. Using this nonce, the attacker can upload a PHP web shell directly to the server's uploads directory. The plugin's response returns the full, accessible URL of the uploaded file, enabling the attacker to execute remote code on the affected site's server.

CVE-2026-96652 is an unauthenticated server-side request forgery (SSRF) vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw exists within the `/player/timeline` endpoint, where the application fails to validate the `protocol` parameter before inserting it into a programmatically-constructed player URL. By supplying any `X-Plex-Token` value and including a full URL in the `protocol` parameter, an attacker can force the Plex server to send a POST request to an arbitrary destination of their choice. This vulnerability is part of a chain of four flaws collectively known as "Plex2Shell". When chained together, these vulnerabilities allow attackers to achieve unauthenticated remote code execution on exposed Plex Media Server instances. Following the public release of a proof-of-concept exploit, threat actors have actively targeted unpatched servers to deploy cryptocurrency miners and proxy software. Plex addressed the vulnerability in version 1.43.3.10861, which was released in August 2026.

CVE-2026-96656 is an external control of file name or path vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw allows an administrator—or an attacker who has obtained administrative privileges—to write arbitrary files, specifically ELF shared objects (`.so` files), to an attacker-chosen path within the server's Codecs directory. Because Plex Media Server loads and executes all `.so` files in this directory at startup without verifying signatures, execute bits, or symbols, this arbitrary file write leads to code execution. Additionally, the vulnerability involves the `TranscoderH264Options` preference, which is appended verbatim to the x264 option string during transcoding. This vulnerability serves as the final stage of a four-part exploit chain known as "Plex2Shell," which also includes CVE-2026-96652, CVE-2026-96654, and CVE-2026-96655. When combined, these flaws allow unauthenticated remote code execution on exposed Plex Media Server instances. Following the public release of a proof-of-concept exploit in October 2026, threat actors began actively targeting unpatched servers in the wild to deploy payloads such as XMRig cryptocurrency miners and reverse proxy software. Plex addressed the issue in an update released in August 2026.

CVE-2026-96655 is a server-side request forgery (SSRF) vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw resides in the `/video/:/transcode/universal` path parameter, where it allows an authenticated user possessing the owner's token to request arbitrary internal or external network addresses. Discovered by security researcher Zach Main, the vulnerability was patched by Plex in August 2026. This vulnerability is a component of "Plex2Shell," a chain of four vulnerabilities that can be combined to achieve unauthenticated remote code execution on exposed Plex servers. Following the public release of technical details and proof-of-concept code in October 2026, attackers began actively exploiting this chain in the wild. Observed attacks have utilized the exploit chain to deploy cryptocurrency miners and residential proxy software on vulnerable systems.

CVE-2026-96654 is a vulnerability affecting Plex Media Server versions prior to 1.43.3.10861. The flaw arises from the improper neutralization of URL values within the "searchOne" endpoint. This allows an attacker to call functions belonging to other plugins and supply custom parameters, enabling them to obtain the server owner's administrator token. This vulnerability is tracked as part of a chain of four security flaws collectively referred to as "Plex2Shell". When chained together, these flaws allow attackers to execute arbitrary code on vulnerable Plex Media Server instances without needing valid credentials. Following the public release of a proof-of-concept exploit, threat actors have actively targeted these vulnerabilities in the wild to deploy cryptocurrency miners and reverse proxy software. The issue was patched by Plex in August 2026.