Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Tautulli — Vulnerabilities & Security Advisories 18

All 18 CVE vulnerabilities found in Tautulli, with AI-generated Chinese analysis, references, and POCs.

This page aggregates security vulnerabilities and advisories for Tautulli, a web-based monitoring and statistics application for SABnzbd and Transmission, focusing on specific weakness types and associated security tags. It collects reported issues ranging from authentication flaws to cross-site scripting, covering vulnerabilities disclosed from the product's initial release through recent years. Readers can use this resource to track the vendor's official advisories, understand the prevalence of particular weakness classes within this software category, and review the complete vulnerability history for Tautulli. The aggregation helps security professionals and users identify potential risks in their stack, understand common attack vectors targeting monitoring dashboards, and assess the long-term security posture of the application. By centralizing data from multiple sources, this view provides a comprehensive overview of how security issues in Tautulli have evolved over time, enabling better-informed decisions regarding patching and system hardening. The data presented here is strictly factual, intended for informational purposes, and does not include remediation steps or specific exploit details, directing users to official vendor channels for comprehensive guidance on securing their installations.

Vendor: Tautulli

CVE ID Title CVSS Severity Published
CVE-2026-45381 Tautulli: Reflected XSS in `/search` endpoint CWE-79 5.1 Medium 2026-09-21
CVE-2026-49995 Tautulli: Stored Cross-Site Scripting (XSS) in the newsletter CWE-79 4.8 Medium 2026-09-21
CVE-2026-54915 Tautulli: Open redirect via whitespace bypass in /auth/redirect CWE-601 5.4 Medium 2026-09-21
CVE-2026-52835 Tautulli: Path traversal / arbitrary file write via unsanitized upload filename in import_config and import_database CWE-22 7.0 High 2026-09-21
CVE-2026-43986 Tautulli vulnerable to unauthenticated SSRF in /image/<hash> via attacker-seeded image hash replay CWE-918 9.9 Critical 2026-06-04
CVE-2026-43985 Taultulli has CSRF in /configUpdate via missing anti-CSRF and method restriction that allows admin credential takeover CWE-352 8.8 High 2026-06-04
CVE-2026-43984 Tautulli has stored XSS in logFile via guest-controlled log_js_errors input CWE-79 8.9 High 2026-06-04
CVE-2026-41065 Tautulli Vulnerable to Unauthenticated/Authenticated Remote Code Execution via Newsletter Custom Template Directory CWE-1336 - - 2026-06-04
CVE-2026-40605 Tautulli Vulnerable to Authenticated Path Traversal in Cache Deletion API CWE-22 - - 2026-06-04
CVE-2026-32275 Tautulli: Unsanitized JSONP callback parameter allows cross-origin script injection and API key theft CWE-79 7.6 - 2026-03-30
CVE-2026-31799 Tautulli: SQL Injection in get_home_stats API endpoint via unsanitised filter parameters CWE-89 4.9 Medium 2026-03-30
CVE-2026-31831 Tautulli: Unauthenticated Path Traversal in `/newsletter/image/images` endpoint CWE-23 7.5 - 2026-03-30
CVE-2026-31804 Tautulli: Unauthenticated pms_image_proxy endpoint proxies arbitrary HTTP requests through the Plex Media Server CWE-918 4.0 Medium 2026-03-30
CVE-2026-28505 Tautulli: RCE via eval() sandbox bypass using lambda nested scope to escape co_names whitelist check CWE-94 9.8 - 2026-03-30
CVE-2025-58763 Tautulli vulnerable to Authenticated Remote Code Execution via Command Injection CWE-78 8.1 High 2025-09-09
CVE-2025-58762 Tautulli vulnerable to Authenticated Remote Code Execution via write primitive and `Script` notification agent CWE-73 9.1 Critical 2025-09-09
CVE-2025-58761 Tautulli vulnerable to Unauthenticated Path Traversal in `real_pms_image_proxy` CWE-27 8.6 High 2025-09-09
CVE-2025-58760 Tautulli vulnerable to Unauthenticated Path Traversal in `/image` endpoint CWE-23 8.6 High 2025-09-09

All 18 known CVE vulnerabilities affecting Tautulli with full Chinese analysis, references, and POCs where available.