CVE-2026-96654 — Plex Media Server improper neutralization of encoded URI schemes in a web page vulnerability

The CISA Known Exploited Vulnerabilities Catalog includes CVE-2026-96654, a Plex Media Server vulnerability involving improper neutralization of encoded URI schemes in a web page. CISA describes the KEV Catalog as the authoritative source for vulnerabilities that have been exploited in the wild.