Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability
Exploited in the wild. CISA added it to its Known Exploited Vulnerabilities list on 20 Oct 2026.
1.9%
Reading the vendor advisory
Fix it in your code
Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-96654. Nothing runs until you send it.
Plex Media Server contains an improper neutralization of encoded URI schemes in a web page vulnerability that could allow an attacker to call other plugins' functions and supply their own parameters. This vulnerability can be chained with CVE-2026-96652, CVE-2026-96655, and CVE-2026-96656.
You are affected if
The fix