CVE-2026-43984

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Versions prior to 2.17.1 expose `log_js_errors` to any authenticated user, including guest users when guest access is enabled. The endpoint writes attacker-controlled strings directly into the main application log. The administrator-only `logFile` view then reads that log file and embeds it into an HTML response without escaping. This creates a stored cross-site scripting condition where a low-privilege guest can inject HTML or JavaScript into the log file and have it execute in an administrator's browser when the log viewer is opened. Version 2.17.1 patches the issue.

• CWE-79

• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.1
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-f4j7-pjwc-4jrr
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-f4j7-pjwc-4jrr

Published

Jun 4, 2026

Last Modified

Jul 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-43978wger is a free, open-source workout and fitness manager. In …8.1
• CVE-2026-43979Local Deep Research is an AI-powered research assistant for …5
• CVE-2026-4398Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-43981Algernon is a small self-contained pure-Go web server. Prior…8.2
• CVE-2026-43982Algernon is a small self-contained pure-Go web server. Prior…8.7
• CVE-2026-43983Pocket ID is an OIDC provider that allows users to authentic…8.1
• CVE-2026-43985Tautulli is a Python based monitoring and tracking tool for …8.8
• CVE-2026-43986Tautulli is a Python based monitoring and tracking tool for …9.9
• CVE-2026-43988Vanetza is an open-source implementation of the ETSI C-ITS p…7.5
• CVE-2026-43989JunoClaw is an agentic AI platform built on Juno Network. Pr…8.5
• CVE-2026-4399Prompt injection vulnerability in 1millionbot Millie chatbot…7.5
• CVE-2026-43990JunoClaw is an agentic AI platform built on Juno Network. Pr…8.4