{"schema_version":1,"title":"Tautulli vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 9 vulnerabilities in Tautulli: 4 in the last 7 days and 4 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-54915, was published on 21 September 2026.","url":"https://junglewise.ai/threats/technologies/tautulli","json_url":"https://junglewise.ai/threats/technologies/tautulli.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/tautulli","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":2,"all_time":9,"critical":1,"exploited":0,"last_7_days":4,"last_30_days":4,"last_90_days":4,"last_365_days":9},"latest":[{"cve":"CVE-2026-54915","cvss":5.4,"epss":0.0026,"slug":"cve-2026-54915-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex","title":"Tautulli open redirect via whitespace bypass in /auth/redirect","severity":"medium","exploited":false,"published_at":"2026-09-21T20:17:26.333+00:00","url":"https://junglewise.ai/threats/cve-2026-54915-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex"},{"cve":"CVE-2026-52835","epss":0.0059,"slug":"cve-2026-52835-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex","title":"Tautulli path traversal in file upload handlers","severity":"info","exploited":false,"published_at":"2026-09-21T20:17:26.14+00:00","url":"https://junglewise.ai/threats/cve-2026-52835-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex"},{"cve":"CVE-2026-49995","epss":0.006,"slug":"cve-2026-49995-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex","title":"Tautulli stored XSS in newsletter cron field","severity":"info","exploited":false,"published_at":"2026-09-21T20:17:25.797+00:00","url":"https://junglewise.ai/threats/cve-2026-49995-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex"},{"cve":"CVE-2026-45381","epss":0.0059,"slug":"cve-2026-45381-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex","title":"Tautulli reflected XSS in search query","severity":"info","exploited":false,"published_at":"2026-09-21T20:17:25.263+00:00","url":"https://junglewise.ai/threats/cve-2026-45381-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex"},{"cve":"CVE-2026-43986","cvss":9.9,"slug":"cve-2026-43986-tautulli-unauthenticated-ssrf-in-image-route","title":"Tautulli unauthenticated SSRF in image route","severity":"critical","exploited":false,"published_at":"2026-06-04T16:16:38.29+00:00","url":"https://junglewise.ai/threats/cve-2026-43986-tautulli-unauthenticated-ssrf-in-image-route"},{"cve":"CVE-2026-43985","cvss":8.8,"slug":"cve-2026-43985-tautulli-csrf-in-configupdate-allows-administrator-takeover","title":"Tautulli CSRF in configUpdate allows administrator takeover","severity":"high","exploited":false,"published_at":"2026-06-04T16:16:38.083+00:00","url":"https://junglewise.ai/threats/cve-2026-43985-tautulli-csrf-in-configupdate-allows-administrator-takeover"},{"cve":"CVE-2026-43984","cvss":8.9,"slug":"cve-2026-43984-tautulli-stored-xss-in-logfile-via-log-js-errors","title":"Tautulli stored XSS in logFile via log_js_errors","severity":"high","exploited":false,"published_at":"2026-06-04T16:16:37.883+00:00","url":"https://junglewise.ai/threats/cve-2026-43984-tautulli-stored-xss-in-logfile-via-log-js-errors"},{"cve":"CVE-2026-41065","cvss":8.9,"slug":"cve-2026-41065-tautulli-remote-code-execution-in-newsletter-custom-template","title":"Tautulli remote code execution in newsletter custom template directory","severity":"info","exploited":false,"published_at":"2026-06-04T15:16:53.873+00:00","url":"https://junglewise.ai/threats/cve-2026-41065-tautulli-remote-code-execution-in-newsletter-custom-template"},{"cve":"CVE-2026-40605","cvss":5.7,"slug":"cve-2026-40605-tautulli-path-traversal-in-cache-deletion-api","title":"Tautulli path traversal in cache deletion API","severity":"info","exploited":false,"published_at":"2026-06-04T14:16:40.52+00:00","url":"https://junglewise.ai/threats/cve-2026-40605-tautulli-path-traversal-in-cache-deletion-api"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":4}],"related":[],"technology":{"hub":true,"name":"Tautulli","slug":"tautulli","vendor":{"name":"Tautulli","slug":"tautulli","url":"https://junglewise.ai/threats/vendors/tautulli"},"aliases":[],"category":"application","homepage":"https://tautulli.com/","repo_url":"https://github.com/Tautulli/Tautulli","description":"A 3rd party web application for monitoring, analytics and notifications for Plex Media Server.","url":"https://junglewise.ai/threats/technologies/tautulli"},"most_severe":[{"cve":"CVE-2026-43986","cvss":9.9,"slug":"cve-2026-43986-tautulli-unauthenticated-ssrf-in-image-route","title":"Tautulli unauthenticated SSRF in image route","severity":"critical","exploited":false,"published_at":"2026-06-04T16:16:38.29+00:00","url":"https://junglewise.ai/threats/cve-2026-43986-tautulli-unauthenticated-ssrf-in-image-route"},{"cve":"CVE-2026-43984","cvss":8.9,"slug":"cve-2026-43984-tautulli-stored-xss-in-logfile-via-log-js-errors","title":"Tautulli stored XSS in logFile via log_js_errors","severity":"high","exploited":false,"published_at":"2026-06-04T16:16:37.883+00:00","url":"https://junglewise.ai/threats/cve-2026-43984-tautulli-stored-xss-in-logfile-via-log-js-errors"},{"cve":"CVE-2026-43985","cvss":8.8,"slug":"cve-2026-43985-tautulli-csrf-in-configupdate-allows-administrator-takeover","title":"Tautulli CSRF in configUpdate allows administrator takeover","severity":"high","exploited":false,"published_at":"2026-06-04T16:16:38.083+00:00","url":"https://junglewise.ai/threats/cve-2026-43985-tautulli-csrf-in-configupdate-allows-administrator-takeover"},{"cve":"CVE-2026-54915","cvss":5.4,"epss":0.0026,"slug":"cve-2026-54915-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex","title":"Tautulli open redirect via whitespace bypass in /auth/redirect","severity":"medium","exploited":false,"published_at":"2026-09-21T20:17:26.333+00:00","url":"https://junglewise.ai/threats/cve-2026-54915-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex"},{"cve":"CVE-2026-41065","cvss":8.9,"slug":"cve-2026-41065-tautulli-remote-code-execution-in-newsletter-custom-template","title":"Tautulli remote code execution in newsletter custom template directory","severity":"info","exploited":false,"published_at":"2026-06-04T15:16:53.873+00:00","url":"https://junglewise.ai/threats/cve-2026-41065-tautulli-remote-code-execution-in-newsletter-custom-template"},{"cve":"CVE-2026-40605","cvss":5.7,"slug":"cve-2026-40605-tautulli-path-traversal-in-cache-deletion-api","title":"Tautulli path traversal in cache deletion API","severity":"info","exploited":false,"published_at":"2026-06-04T14:16:40.52+00:00","url":"https://junglewise.ai/threats/cve-2026-40605-tautulli-path-traversal-in-cache-deletion-api"},{"cve":"CVE-2026-49995","epss":0.006,"slug":"cve-2026-49995-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex","title":"Tautulli stored XSS in newsletter cron field","severity":"info","exploited":false,"published_at":"2026-09-21T20:17:25.797+00:00","url":"https://junglewise.ai/threats/cve-2026-49995-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex"},{"cve":"CVE-2026-52835","epss":0.0059,"slug":"cve-2026-52835-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex","title":"Tautulli path traversal in file upload handlers","severity":"info","exploited":false,"published_at":"2026-09-21T20:17:26.14+00:00","url":"https://junglewise.ai/threats/cve-2026-52835-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex"},{"cve":"CVE-2026-45381","epss":0.0059,"slug":"cve-2026-45381-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex","title":"Tautulli reflected XSS in search query","severity":"info","exploited":false,"published_at":"2026-09-21T20:17:25.263+00:00","url":"https://junglewise.ai/threats/cve-2026-45381-tautulli-is-a-python-based-monitoring-and-tracking-tool-for-plex"}],"generated_at":"2026-09-26T12:07:00.15149+00:00"}