Tautulli

MediaDesktop

Monitors a Plex Media Server and reports on what is being watched.

Latest v2.17.2 · · Desktopby TautulliWebsiteTautulli/Tautulli

Release activity

Release activity — 5 releases across 5 days in the last year. Each cell is one day; darker means more releases that day. Older weeks are hidden at this screen width.
MayJunJulAug
SundayNo releases on Apr 26, 2026No releases on May 3, 2026No releases on May 10, 2026No releases on May 17, 2026No releases on May 24, 2026No releases on May 31, 2026No releases on Jun 7, 2026No releases on Jun 14, 2026No releases on Jun 21, 2026No releases on Jun 28, 2026No releases on Jul 5, 2026No releases on Jul 12, 2026No releases on Jul 19, 2026No releases on Jul 26, 2026No releases on Aug 2, 2026No releases on Aug 9, 2026
MondayNo releases on Apr 27, 2026No releases on May 4, 2026No releases on May 11, 2026No releases on May 18, 2026No releases on May 25, 2026No releases on Jun 1, 2026No releases on Jun 8, 2026No releases on Jun 15, 2026No releases on Jun 22, 2026No releases on Jun 29, 2026No releases on Jul 6, 2026No releases on Jul 13, 2026No releases on Jul 20, 2026No releases on Jul 27, 2026No releases on Aug 3, 2026No releases on Aug 10, 2026
TuesdayNo releases on Apr 28, 20261 release on May 5, 2026No releases on May 12, 2026No releases on May 19, 2026No releases on May 26, 2026No releases on Jun 2, 2026No releases on Jun 9, 20261 release on Jun 16, 2026No releases on Jun 23, 2026No releases on Jun 30, 2026No releases on Jul 7, 2026No releases on Jul 14, 2026No releases on Jul 21, 2026No releases on Jul 28, 2026No releases on Aug 4, 2026No releases on Aug 11, 2026
WednesdayNo releases on Apr 29, 2026No releases on May 6, 2026No releases on May 13, 2026No releases on May 20, 2026No releases on May 27, 2026No releases on Jun 3, 2026No releases on Jun 10, 2026No releases on Jun 17, 2026No releases on Jun 24, 2026No releases on Jul 1, 2026No releases on Jul 8, 2026No releases on Jul 15, 2026No releases on Jul 22, 2026No releases on Jul 29, 2026No releases on Aug 5, 2026No releases on Aug 12, 2026
ThursdayNo releases on Apr 30, 2026No releases on May 7, 2026No releases on May 14, 2026No releases on May 21, 2026No releases on May 28, 2026No releases on Jun 4, 2026No releases on Jun 11, 2026No releases on Jun 18, 2026No releases on Jun 25, 2026No releases on Jul 2, 2026No releases on Jul 9, 2026No releases on Jul 16, 2026No releases on Jul 23, 2026No releases on Jul 30, 2026No releases on Aug 6, 2026
FridayNo releases on May 1, 2026No releases on May 8, 2026No releases on May 15, 2026No releases on May 22, 2026No releases on May 29, 2026No releases on Jun 5, 2026No releases on Jun 12, 2026No releases on Jun 19, 2026No releases on Jun 26, 2026No releases on Jul 3, 2026No releases on Jul 10, 2026No releases on Jul 17, 2026No releases on Jul 24, 2026No releases on Jul 31, 2026No releases on Aug 7, 2026
SaturdayNo releases on May 2, 2026No releases on May 9, 2026No releases on May 16, 2026No releases on May 23, 2026No releases on May 30, 2026No releases on Jun 6, 2026No releases on Jun 13, 2026No releases on Jun 20, 2026No releases on Jun 27, 2026No releases on Jul 4, 2026No releases on Jul 11, 2026No releases on Jul 18, 2026No releases on Jul 25, 2026No releases on Aug 1, 2026No releases on Aug 8, 2026

5 releases in the last year

Changelog

v2.17.2

Tautulli v2.17.2

Fixed 4
  • Line breaks in Gotify notification body text
  • Duplicated activity card progress timers
  • X-Api-Key header check crashing server
  • Empty host fallback in URL when launching browser
Security 4
  • XSS in newsletter cron value (CVE-2026-49995)
  • Reflected XSS in search query string (CVE-2026-45381)
  • Path traversal in uploaded database and config file names (CVE-2026-52835)
  • Open redirect via whitespace bypass in /auth/redirect (CVE-2026-54915)
Changelog
v2.17.2 (2026-06-16)
  • Notifications:
    • Fix: Line breaks in Gotify notification body text. (#2702)
  • Newsletters:
    • Fix: XSS in newsletter cron value. (CVE-2026-49995) (Thanks @elvinsuleymanov)
  • UI:
    • Fix: Reflected XSS in search query string. (CVE-2026-45381) (Thanks @JakePeralta7, @sondt99, @kah-ja)
    • Fix: Duplicated activity card progress timers. (#2716) (Thanks @omglazrgunpewpew)
  • Other:
    • Fix: Fix X-Api-Key header check crashing server. (#2711)
    • Fix: Path traversal in uploaded database and config file names. (CVE-2026-52835) (Thanks @tonghuaroot)
    • Fix: Empty host fallback in URL when launching browser. (#2722) (Thanks @upmcplanetracker)
    • Fix: Open redirect via whitespace bypass in /auth/redirect (CVE-2026-54915) (Thanks @sondt99)

🛡 VirusTotal GitHub Action analysis:

View originalPermalink
How v2.17.2 went
v2.17.1

Tautulli v2.17.1

Added 4
  • Added extra type and preroll to notification parameters
  • Added Simkl URL to notification parameters
  • Added AV1 media flag image
  • Added opus media flag image
Changed 4
  • Update Windows and MacOS packages to Python 3.13
  • Update Snap package to core24
  • Using mounted folders for custom newsletter templates and scripts requires manually enabling allow_mounted_folders = 1 in the config file
  • Hash Tautulli cookie name and invalidate all existing login sessions after the update
Fixed 6
  • Tautulli Remote App notifications failing to send
  • Export failed when logo / square art keys were included
  • Error when browsing for folder paths
  • Clean empty directories after updating using git
  • Tautulli failing to reconnect to Plex Media Server until restarted after a connection loss at startup
  • Websocket not exiting and reconnecting cleanly after changing Plex servers
Security 6
  • Fixed remote code execution via newsletter custom template directory (CVE-2026-41065)
  • Fixed path traversal in cache deletion API (CVE-2026-40605)
  • Sanitize JS log errors to prevent XSS (CVE-2026-43984)
  • Do not store image hash for external images (CVE-2026-43986)
  • Added anti-CSRF tokens and enforce POST methods to state change endpoints (CVE-2026-43985)
  • Require X-Api-Key header for login through the /auth/signin endpoint
Changelog
v2.17.1 (2026-05-04)
  • Notifications:
    • Fix: Tautulli Remote App notifications failing to send. (#2669)
    • New: Added extra type and preroll to notification parameters.
    • New: Added Simkl URL to notification parameters.
  • Newsletters:
    • Fix: Remote code execution via newsletter custom template directory. (CVE-2026-41065) (Thanks @remindsec)
  • Exporter:
    • Fix: Export failed when logo / square art keys were included. (#2685)
  • UI:
    • Fix: Error when browsing for folder paths. (#2673)
    • New: Added AV1 media flag image. (#2676) (Thanks @little0831)
    • New: Added opus media flag image.
  • Other:
    • Fix: Clean empty directories after updating using git. (#2667)
    • Fix: Tautulli failing to reconnect to Plex Media Server until restarted after a connection loss at startup. (#2640)
    • Fix: Path treversal in cache deletion API. (CVE-2026-40605) (Thanks @JakePeralta7)
    • Fix: Websocket not exiting and reconnecting cleanly after changing Plex servers.
    • Fix: Sanitize JS log errors to prevent XSS. (CVE-2026-43984) (Thanks @larlarua)
    • Fix: Do not store image hash for external images. (CVE-2026-43986) (Thanks @larlarua)
    • New: Update Windows and MacOS packages to Python 3.13.
    • New: Update Snap package to core24.
    • New: Using mounted folders for custom newsletter templates and scripts requires manually enabling allow_mounted_folders = 1 in the config file.
    • New: Added anti-CSRF tokens and enforce POST methods to state change endpoints. (CVE-2026-43985) (Thanks @larlarua)
    • New: Hash Tautulli cookie name. All existing login sessions will be invalidated after the update.
    • New: Require X-Api-Key header for login through the /auth/signin endpoint.

🛡 VirusTotal GitHub Action analysis:

View originalPermalink
How v2.17.1 went
v2.17.0

Tautulli v2.17.0

Added 3
  • Added ability to export square art images
  • Added ability to export theme music
  • Added rating to get_home_stats API command
Changed 3
  • Updated Bootstrap CSS to v3.4.1 and decouple overrides
  • Updated Bootstrap-select to v1.13.18
  • Updated third party donation logos
Fixed 4
  • Media from other video libraries using modern Plex agents not showing up on newsletter
  • Logo images incorrectly exported as jpg instead of png
  • History modal not opening when clicking on graphs
  • Validate log path for Plex log files
Removed 2
  • Support for Python 3.9 has been dropped; minimum Python version is now 3.10
  • Removed get_apikey API command
Security 5
  • Prevent RCE in notification text evaluation (CVE-2026-28505)
  • Fix unauthenticated path traversal in /newsletter/image/images endpoint (CVE-2026-31831)
  • Fix SQL injection in get_home_stats API command (CVE-2026-31799)
  • Fix unsanitized JSONP callback parameter (CVE-2026-32275)
  • Add authentication to /pms_image_proxy endpoint (CVE-2026-31804)
Changelog
v2.17.0 (2026-03-27)
  • Important Note!
    • Several security vulnerabilities have been identified in Tautulli versions <=2.16.1. Users are strongly encouraged to update to the latest Tautulli version 2.17.x.
  • Notes:
    • Support for Python 3.9 has been dropped. The minimum Python version is now 3.10.
  • Notifications:
    • Fix: Prevent RCE in notification text evaluation. (CVE-2026-28505) (Thanks @q1uf3ng)
  • Newsletters:
    • Fix: Media from other video libraries using the modern Plex agents not showing up on newsletter.
    • Fix: Unauthenticated path traversal in /newsletter/image/images endpoint. (CVE-2026-31831) (Thanks @JakePeralta7)
  • Exporter:
    • Fix: Logo images incorrectly exported as jpg instead of png.
    • New: Added ability to export square art images.
    • New: Added ability to export theme music. (#2654)
  • Graphs:
    • Fix: History modal not opening when clicking on graphs. (#2652)
  • API:
    • Fix: SQL injection in get_home_stats API command. (CVE-2026-31799) (Thanks @mandreko)
    • Fix: Unsanitized JSONP callback parameter. (CVE-2026-32275) (Thanks @mandreko)
    • New: Added rating to get_home_stats API command. (#2655) (Thanks @jma1ice)
    • Removed: get_apikey API command.
  • Other:
    • Fix: Validate log path for Plex log files. (#2632)
    • Fix: Add authentication to /pms_image_proxy endpoint. (CVE-2026-31804) (Thanks @mandreko)
    • New: Updated third party donation logos. (#2646) (Thanks @aisgbnok)
    • New: Update Bootstrap CSS to v3.4.1 and decouple overrides (#2662) (Thanks @aisgbnok)
    • New: Update Bootstrap-select to v1.13.18 (#2666) (Thanks @aisgbnok)

🛡 VirusTotal GitHub Action analysis:

View originalPermalink
How v2.17.0 went
v2.16.1

Tautulli v2.16.1

Added 4
  • Add Tautulli Plex token expired notification trigger
  • Add Ace editor for syntax highlighting and code formatting for newsletter message text
  • Add DD:HH:MM time format for home stats
  • Add HH:MM:SS time format for activity cards
Changed 2
  • Restrict graphs to guest user
  • Zip backup files to reduce file size
Removed 1
  • Remove timezone from IP address modal
Changelog
v2.16.1 (2026-12-15)
  • Notifications:
    • New: Add Tautulli Plex token expired notification trigger.
  • Newsletters:
    • New: Add Ace editor for syntax highlighting and code formatting for newsletter message text (#2585) (Thanks @mcclown)
  • Graphs:
    • Change: Restrict graphs to guest user.
  • UI:
    • New: Add DD:HH:MM time format for home stats.
    • New: Add HH:MM:SS time format for activity cards.
    • Removed: Timezone from IP address modal.
  • Other:
    • Change: Zip backup files to reduce file size.

🛡 VirusTotal GitHub Action analysis:

View originalPermalink
How v2.16.1 went
v2.16.0

Tautulli v2.16.0

Fixed 2
  • Race condition in image cache directory creation
  • Update poster click-through overlay to new Plex logo
Security 4
  • Validate image path in /image endpoints (CVE-2025-58760)
  • Validate image path in /pms_image_proxy endpoints (CVE-2025-58761)
  • Validate image format in /pms_image_proxy endpoint (CVE-2025-58762)
  • Don't run git command with shell (CVE-2025-58763)
Changelog
v2.16.0 (2025-09-08)
  • Important Note!
    • Several security vulnerabilities have been identified in Tautulli versions <=2.15.3. Users are strongly encouraged to update to the latest Tautulli version 2.16.x.
  • UI:
    • Fix: Update poster click-through overlay to new Plex logo. (#2584) (Thanks @TheMeanCanEHdian)
  • Other:
    • Fix: Race condition in image cache directory creation. (#2580) (Thanks @keithah)
    • Fix: Validate image path in /image endpoints. (CVE-2025-58760) (Thanks @d-xuan)
    • Fix: Validate image path in /pms_image_proxy endpoints. (CVE-2025-58761) (Thanks @d-xuan)
    • Fix: Validate image format in /pms_image_proxy endpoint. (CVE-2025-58762) (Thanks @d-xuan)
    • Fix: Don't run git command with shell. (CVE-2025-58763) (Thanks @d-xuan)

🛡 VirusTotal GitHub Action analysis:

View originalPermalink
How v2.16.0 went
v2.15.3

Tautulli v2.15.3

Added 3
  • Added hearingImpaired for subtitles and visualImpaired for audio attributes to exporter fields
  • Added ability to return svg files using pms_image_proxy API command
  • Added ability to set config values using environment variables
Fixed 5
  • Remove duplicate "Total" entry in graph tooltips
  • Failing to retrieve collections / playlists with over 1000 items
  • Scrollbar not showing on macosx and webkit browsers
  • Incorrect rounding of minutes in global stats play duration
  • Disable browser autocomplete for notification agent and newsletter agent configurations
Changelog
v2.15.3 (2025-08-03)
  • Exporter:
    • New: Added hearingImpaired for subtitles and visualImpaired for audio attributes to exporter fields.
  • Graphs:
    • Fix: Remove duplicate "Total" entry in graph tooltips. (Thanks @zdimension) (#2534)
  • UI:
    • Fix: Failing to retrieve collections / playlists with over 1000 items.
    • Fix: Scrollbar not showing on macosx and webkit browsers. (#2221)
    • Fix: Incorrect rounding of minutes in global stats play duration.
    • Fix: Disable browser autocomplete for notification agent and newsletter agent configurations. (#2557)
  • API:
    • New: Added ability to return svg files using pms_image_proxy API command.
  • Other:
    • New: Added ability to set config values using environment variables. (Thanks @komuw) (#2309, #2543)

🛡 VirusTotal GitHub Action analysis:

View originalPermalink
How v2.15.3 went
v2.15.2

Tautulli v2.15.2

Added 5
  • Added link to library by clicking media type icon in Activity
  • Added stream count to tab title on homepage
  • Added audio profile notification parameters
  • Added PATCH method for Webhook notifications
  • Added Total line to daily streams graph
Changed 1
  • Swap source and stream columns in stream info modal
Fixed 7
  • Check stream watched status before stream stopped status in History
  • ntfy notifications failing to send if provider link is blank
  • Check Pushover notification attachment is under 5MB limit
  • Track URLs redirecting to the correct media page in Notifications
  • Do not redirect API requests to the login page
  • Various typos
  • CherryPy CORS response header not being set correctly
Changelog
v2.15.2 (2025-04-12)
  • Activity:
    • New: Added link to library by clicking media type icon.
    • New: Added stream count to tab title on homepage. (#2517)
  • History:
    • Fix: Check stream watched status before stream stopped status. (#2506)
  • Notifications:
    • Fix: ntfy notifications failing to send if provider link is blank.
    • Fix: Check Pushover notification attachment is under 5MB limit. (#2396)
    • Fix: Track URLs redirecting to the correct media page. (#2513)
    • New: Added audio profile notification parameters.
    • New: Added PATCH method for Webhook notifications.
  • Graphs:
    • New: Added Total line to daily streams graph. (Thanks @zdimension) (#2497)
  • UI:
    • Fix: Do not redirect API requests to the login page. (#2490)
    • Change: Swap source and stream columns in stream info modal.
  • Other:
    • Fix: Various typos. (Thanks @luzpaz) (#2520)
    • Fix: CherryPy CORS response header not being set correctly. (#2279)

🛡 VirusTotal GitHub Action analysis:

View originalPermalink
How v2.15.2 went
v2.15.1

Tautulli v2.15.1

Added 1
  • Added logos to season and episode exports
Fixed 3
  • Detection of HDR transcodes
  • Disable basic authentication for /newsletter and /image endpoints
  • Docker container https health check
Windows installer removed due to antivirus flagging it as a false positive (#2454). Install v2.14.6.
Changelog
v2.15.1 (2025-01-11)
  • Activity:
    • Fix: Detection of HDR transcodes. (Thanks @cdecker08) (#2412, #2466)
  • Newsletters:
    • Fix: Disable basic authentication for /newsletter and /image endpoints. (#2472)
  • Exporter:
    • New: Added logos to season and episode exports.
  • Other:
    • Fix Docker container https health check.

🛡 VirusTotal GitHub Action analysis:

View originalPermalink
How v2.15.1 went
v2.15.0

Tautulli v2.15.0

Added 7
  • Allow Telegram blockquote and tg-emoji HTML tags in notifications
  • Added Plex slug and Plex Watch URL notification parameters
  • Added movie and episode hasVoiceActivity attribute to exporter fields
  • Added subtitle canAutoSync attribute to exporter fields
  • Added logos to the exporter fields
  • Add friendly name to the top bar of config modals
  • Added plex slugs to metadata in the get_metadata API command
Changed 1
  • Update OneSignal API calls to use the new API endpoint for Tautulli Remote App notifications
Fixed 3
  • Dumping custom dates in raw newsletter json
  • Unable to fix match for artists
  • Tautulli failing to start with Python 3.13
Removed 1
  • Support for Python 3.8 has been dropped; the minimum Python version is now 3.9
Windows installer removed due to antivirus flagging it as a false positive (#2454). Install v2.14.6.
Changelog
v2.15.0 (2024-11-24)
  • Notes:
    • Support for Python 3.8 has been dropped. The minimum Python version is now 3.9.
  • Notifications:
    • New: Allow Telegram blockquote and tg-emoji HTML tags. (Thanks @MythodeaLoL) (#2427)
    • New: Added Plex slug and Plex Watch URL notification parameters. (#2420)
    • Change: Update OneSignal API calls to use the new API endpoint for Tautulli Remote App notifications.
  • Newsletters:
    • Fix: Dumping custom dates in raw newsletter json.
  • History:
    • Fix: Unable to fix match for artists. (#2429)
  • Exporter:
    • New: Added movie and episode hasVoiceActivity attribute to exporter fields.
    • New: Added subtitle canAutoSync attribute to exporter fields.
    • New: Added logos to the exporter fields.
  • UI:
    • New: Add friendly name to the top bar of config modals. (Thanks @peagravel) (#2432)
  • API:
    • New: Added plex slugs to metadata in the get_metadata API command.
  • Other:
    • Fix: Tautulli failing to start with Python 3.13. (#2426)
View originalPermalink
How v2.15.0 went
v2.14.6

Tautulli v2.14.6

Changed 1
  • Support apscheduler compatible cron expressions in newsletters
Fixed 4
  • Allow formatting newsletter date parameters
  • Round runtime before converting to human duration in UI
  • Make recently added/watched rows touch scrollable in UI
  • Auto-updater not running
Changelog
v2.14.6 (2024-10-12)
  • Newsletters:
    • Fix: Allow formatting newsletter date parameters.
    • Change: Support apscheduler compatible cron expressions.
  • UI:
    • Fix: Round runtime before converting to human duration.
    • Fix: Make recently added/watched rows touch scrollable.
  • Other:
    • Fix: Auto-updater not running.
View originalPermalink
How v2.14.6 went

More in Media

View all
IINA

The modern media player for macOS.

IINA
Strawberry

A music player and collection organizer.

Jonas Kvinge
HandBrake

An open-source video transcoder for converting video to modern codecs.

HandBrake Team
ScreenToGif

Record the screen, a webcam or sketches and save as a GIF.

Nicke Manarin
mpv

A free, open-source and cross-platform media player.

mpv
Mixxx

Free DJ software for live mixing.

Mixxx

Discussion