Plex Media Server flaw CVE-2026-96654 lets unauthenticated attackers invoke other plugins' functions

·8 views

CVE-2026-96654 affects Plex Media Server builds before 1.43.3.10861, where URL values passed to the searchOne endpoint are not properly neutralized. An unauthenticated remote attacker can exploit this to call functions of plugins other than the one addressed and supply their own parameters. The vulnerability is rated CVSS v3.1 6.5 with low confidentiality and integrity impact, and CISA marks it as automatable with no known exploitation. Users are advised to update to version 1.43.3.10861 or later, or disable unused plugins and block search requests containing absolute URLs until the upgrade is applied.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Stale Approvals: Why AI Workflows Should Recheck Drafts Before Executing Them

A refund approved by a reviewer can become outdated if the customer sends a new message before the workflow runs it. This stale approval problem is common in human-in-the-loop AI workflows as volume grows. The proposed fix is to approve a specific snapshot of the action, using a fingerprint built from the details that would change the decision, such as new messages, order status, and amount. Before executing, the system compares the current context against that fingerprint and sends the action back to a reviewer if it no longer matches. An idempotency key is also recommended so that retries do not process a refund twice.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Building a daily path puzzle generator that guarantees a single solution

The author built Tracewise, an Android daily logic puzzle where a single path must cover every grid square while passing numbered cells in order. Each day's puzzles must have exactly one solution, generate quickly on the phone, and be identical across devices. The generator first creates a random Hamiltonian path using a backbite move that starts from a snake pattern and is seeded by the date for determinism. A solver then counts solutions, stopping at two, using pruning rules such as checkerboard parity, dead-end detection and connectivity checks. If the solver hits a node limit, the generator adds a clue rather than shipping a puzzle whose uniqueness it cannot prove.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Hearthlen Voice Agent Switches to Qwen2.5-3B for More Context-Aware Replies

A developer building an offline AI operating system called Hearthlen found that the original 360-million-parameter SmolLM2 voice model gave generic, canned-sounding answers. The model was too small to retain user details and respond to them meaningfully. The voice agent now keeps the larger Qwen2.5-3B-Instruct model loaded in 4-bit precision, which takes about 2.1 GB. In a test prompt about having two free hours on a rainy day, it suggested reading a book, drawing on both details. The reply took 39 tokens and 3017 ms to generate, and the interface shows a Thinking state during generation. Plain commands are still routed to a simpler path.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Developer Builds Local AI Tool to Sort Cluttered Files by Category

A developer has created AI File Organizer, a beginner-friendly Python project for the Hacktoberfest Open-Source AI Challenge. The tool reads filenames in a selected folder and uses a locally running Gemma model through Ollama to suggest categories such as Study, Images, Documents, Code, and Archives. Users see a preview of the suggested categories and decide whether to apply the changes, so files are not moved automatically. The project runs without a cloud AI service once the model is downloaded, giving users more control over their data. Planned future features include a graphical interface, nested folder support, duplicate detection, and an undo option.

0 comments Read more at DEV Community