WebPros Plesk

• CVE-2026-68492 High 8.7 An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful AP 0.7%
• CVE-2026-68487 Critical 9.9 Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer. 0.6%
• CVE-2026-68488 Critical 9.9 A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover. 0.4%
• CVE-2026-67397 High 8.5 Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root. 0.2%
• CVE-2026-67394 Critical 9.0 A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerabili 1.3%
• CVE-2026-65646 Critical 9.9 Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges. 0.7%
• CVE-2026-65642 High 8.6 Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases. 0.5%
• CVE-2026-64639 Critical 9.3 Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server adm 0.6%
• CVE-2026-64637 Critical 9.9 Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account. 0.5%
• CVE-2026-64636 High 7.7 An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database. 0.4%
• CVE-2026-58046 Critical 9.9 Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise 0.6%
• CVE-2026-56843 Critical 9.9 Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership is enforced only for c 0.7%
• CVE-2026-48614 Critical 9.9 An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root and full privilege esc 0.6%
• CVE-2026-44962 Critical 9.9 Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allo 0.7%