Product

LastPass

0 mentions in 7 days · 1 in 30 days · 1 total · first seen Sep 4, 2026 · last 11d ago

Timeline1 articles

Plex Urges Immediate Updates After Patching Multiple Undisclosed Security Flaws

Plex patched multiple undisclosed flaws in Media Server 1.43.3 and Desktop 1.115.0, urging all users to update immediately.

Plex released fixes in Plex Media Server 1.43.3 and Plex Desktop 1.115.0 for multiple undisclosed security flaws, with CVE identifiers requested and details not yet published. Censys data shows more than 360,000 devices expose the Plex Media Server web interface. Past Plex flaws saw real exploitation, including CVE-2020-5741 (CVSS 7.2), used to implant a keylogger on a LastPass employee's home computer during the 2022 breach, and CVE-2025-34158 (CVSS 8.5), an authentication bug patched in August 2025.

The Hacker NewsSep 4, 07:35 UTC · 11d agoVulnerability CVE-2025-34158 CVE-2020-5741

Related CVEsby mentions

CVE-2020-57417.273%
Authenticated Deserialization RCE in Plex Media Server on Windows
CVE-2020-5741 is a deserialization-of-untrusted-data flaw (CWE-502) in Plex Media Server on Windows: the server deserializes a serialized Python (pickle) object supplied over the network without adequate validation. A remote attacker who has already authenticated with high-privilege credentials to the server can submit a maliciously crafted serialized object, causing the server to execute arbitrary Python code upon deserialization. Successful exploitation yields code execution in the context of the Plex Media Server process on the Windows host, exposing that machine's data and credentials and, as demonstrated in the 2022 LastPass breach, potentially providing a foothold into connected environments. Windows installations running a release without the vendor's 2020 security fix are affected; Linux/NAS deployments are outside the described scope of this flaw. Exploitation is confirmed: it carries a 72.9% EPSS probability (99th percentile), has public PoC exploits (Tenable TRA-2020-32 and a PacketStorm write-up), was added to CISA's KEV catalog on 2023-03-10, and is publicly linked to the LastPass breach, where an unpatched Plex Media Server on an employee's PC was the entry point.
· Plex Media Server (Windows) KEV PoC ×2large
CVE-2025-341588.5<1%
Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the
Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner (and a /api/resources call reveals other servers accessible by that server owner).
—

Appears with

malware keylogger 1 organization Plex 1 product Plex Desktop 1 product Plex Media Server 1 vendor Censys 1 vendor Plex 1 victim LastPass 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.