https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-32275.htmlhttps://patchthecve.com/cve/CVE-2026-32275.htmlWed, 17 Jun 2026 10:35:28 +0000CRITICAL 9.1: Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before version 2.17.0, an unsanitized JSONP callback parameter allows cross-origin script injection and API key theft. This issue has been patched in version 2.17.0.https://patchthecve.com/cve/CVE-2026-31831.htmlhttps://patchthecve.com/cve/CVE-2026-31831.htmlWed, 17 Jun 2026 10:34:32 +0000HIGH 7.5: Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /newsletter/image/images API endpoint is vulnerable to path traversal, allowing unauthenticated attackers to read arbitrary files from the application server's filesystem. This issue has been https://patchthecve.com/cve/CVE-2026-31804.htmlhttps://patchthecve.com/cve/CVE-2026-31804.htmlWed, 17 Jun 2026 10:34:29 +0000MEDIUM 4.0: Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the /pms_image_proxy endpoint accepts a user-supplied img parameter and forwards it to Plex Media Server's /photo/:/ transcode transcoder without authentication and without restricting the scheme https://patchthecve.com/cve/CVE-2026-31799.htmlhttps://patchthecve.com/cve/CVE-2026-31799.htmlWed, 17 Jun 2026 10:34:29 +0000MEDIUM 4.9: Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 2.14.2 to before version 2.17.0 for parameters "before" and "after" and from version 2.1.0-beta to before version 2.17.0 for parameters "section_id" and "user_id", the /api/v2?cmd=get_home_stats endpoint passhttps://patchthecve.com/cve/CVE-2026-28505.htmlhttps://patchthecve.com/cve/CVE-2026-28505.htmlWed, 17 Jun 2026 10:28:45 +0000CRITICAL 10.0: Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to version 2.17.0, the str_eval() function in notification_handler.py implements a sandboxed eval() for notification text templates. The sandbox attempts to restrict callable names by inspecting code.co_names of the