CVE-2026-32275

CriticalCVSS 9.1/10Last modified Jun 17, 2026

Description

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. From version 1.3.10 to before version 2.17.0, an unsanitized JSONP callback parameter allows cross-origin script injection and API key theft. This issue has been patched in version 2.17.0.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
Tautulli	Tautulli	>= 1.3.10, < 2.17.0

References

https://github.com/Tautulli/Tautulli/releases/tag/v2.17.0Release Notes
https://github.com/Tautulli/Tautulli/security/advisories/GHSA-95mg-wpqw-9qxhExploit, Vendor Advisory

Timeline

Published: Mar 30, 2026
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-322768.8Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to an CVE-2026-322778.7Connect-CMS is a content management system. In versions 1.35.0 through 1.41.0 and 2.35.0 through 2.41.0, a DOM-based Cross-Site Scripting (X CVE-2026-322784.8Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to an CVE-2026-322796.8Connect-CMS is a content management system. In versions on the 1.x series up to and including 1.41.0 and versions on the 2.x series up to an CVE-2026-32286.4The NextScripts: Social Networks Auto-Poster plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the `[nxs_fbembed]` short CVE-2026-322807.5During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed CVE-2026-322817.5Validating certificate chains which use policies is unexpectedly inefficient when certificates in the chain contain a very large number of p CVE-2026-322826.4On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target o CVE-2026-322837.5If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing CVE-2026-322847.5The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This CVE-2026-322857.5The Delete function fails to properly validate offsets when processing malformed JSON input. This can lead to a negative slice index and a r CVE-2026-322867.5The DataRow.Decode function fails to properly validate field lengths. A malicious or compromised PostgreSQL server can send a DataRow messag