CVE tracker

New vulnerabilities – clearly explained

Every newly published security vulnerability (CVE), continuously from the NVD, with the actively exploited ones from CISA and the probability of exploitation (EPSS) – each one researched individually: what is affected, what helps, what to do.

635published today

3402in the last 7 days

249of them critical

11newly exploited (7 days)

1 vulnerability · Vendor: morpheus65535

CVE-2026-61826Critical 10.030 Oct 2026, 18:17

Bazarr: Missing authentication on Plex OAuth API allows config tampering and SSRF

Bazarr, a companion application to Sonarr and Radarr, did not require authentication on several Plex OAuth API endpoints. An unauthenticated attacker who can reach the web interface can clear the Plex credentials, set an attacker-chosen API key, or bind an attacker-controlled Plex account, and can change the Plex server URL. Attacker-controlled URLs then receive the configured API key in the X-Plex-Token header, which enables server-side request forgery and credential exposure. No user interaction is required.

morpheus65535 · Bazarr

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed

Data: NVD (NIST), CISA KEV, FIRST EPSS – updated continuously.