CVE-2026-49995

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletter_config.html into a JavaScript string without safe JSON encoding. An administrator or caller with the Tautulli API key can store a crafted cron value, and an administrator who later opens the newsletter configuration modal passively triggers script execution in the Tautulli web context. The stored value persists in the database and can continue to execute after credential rotation until it is removed. This issue is fixed in version 2.17.2.

• CWE-79

• https://github.com/Tautulli/Tautulli/commit/12761b2d01e78f22e54e8ad8d3133931147cbb77
• https://github.com/Tautulli/Tautulli/releases/tag/v2.17.2
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-r6pg-vqxj-v75j
• https://github.com/Tautulli/Tautulli/security/advisories/GHSA-r6pg-vqxj-v75j

Published

Sep 21, 2026

Last Modified

Sep 22, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-49988Repomix is a tool that packs repositories into AI-friendly f…5.5
• CVE-2026-49989CrateDB is a distributed SQL database. Prior to versions 6.2…7.1
• CVE-2026-4999A security vulnerability has been detected in z-9527 admin u…6.3
• CVE-2026-49991RustFS is a distributed object storage system built in Rust.…8.6
• CVE-2026-49992Kimai is an open-source time tracking application. Versions …6.3
• CVE-2026-49993Nuxt is an open-source web development framework for Vue.js.…5.7
• CVE-2026-49996SecureDrop Client is a desktop app for journalists to secure…3.7
• CVE-2026-49997SurrealDB is a scalable, distributed, collaborative, documen…5.4
• CVE-2026-49998Centrifugo is an open-source scalable real-time messaging se…8.2
• CVE-2026-5000A vulnerability was detected in PromtEngineer localGPT up to…7.3
• CVE-2026-50003A malicious or compromised server can make a DCMTK client us…9.8
• CVE-2026-50005Brickcom cameras ship with default credentials that allows a…8.3