Tautulli has 4 CVEs on record. 4 were published in the last 90 days. The busiest recent month was September 2026 with 4. The median CVSS is 5.3 (medium).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.3
- Publish → KEV
- —
- Last 90 days
- 4 prev 0
Worst active — by depth score
CVE-2026-52835High· 7.0Tautulli is a Python based monitoring and tracking tool for Plex Media Server51CVE-2026-54915Medium· 5.4Tautulli is a Python based monitoring and tracking tool for Plex Media Server42CVE-2026-45381Medium· 5.1Tautulli is a Python based monitoring and tracking tool for Plex Media Server40CVE-2026-49995Medium· 4.8Tautulli is a Python based monitoring and tracking tool for Plex Media Server39
Tautulli vulnerabilities
CVEs affecting Tautulli, newest first. Open any entry for full detail, references, and exploit status.
4 CVEsRSS
CVE-2026-52835High· 7.0PoCTautulli is a Python based monitoring and tracking tool for Plex Media Server
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the import_config handler and the database_file branch of import_database in plexpy/webserve.py join the attacker-controlled config_file.file…
CVE-2026-54915Medium· 5.4PoCTautulli is a Python based monitoring and tracking tool for Plex Media Server
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the unauthenticated /auth/redirect endpoint in plexpy/webauth.py removes forward slashes from the user-controlled redirect_uri parameter but …
CVE-2026-49995Medium· 4.8PoCTautulli is a Python based monitoring and tracking tool for Plex Media Server
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletter_config.html into a JavaScript str…
CVE-2026-45381Medium· 5.1PoCTautulli is a Python based monitoring and tracking tool for Plex Media Server
Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual…