27
CVEs
16
Critical
8
High
0
KEV
1
PoC
3
Unpatched C/H
88.9%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
16
HIGH
8
MEDIUM
3
LOW
0
Monthly CVE Trend
Affected Products (17)
Cpanel
9
Plesk
9
Wp Squared
6
Cpanel Centos 6 Cloudlinux 6
3
Cpanel Cloudlinux 6 Centos 6
2
Configserver Security Firewall
2
Comet Backup
2
Node.js
1
Wp Sqaured
1
Plesk Site Import
1
Whmcs
1
Plesk Extension Ruby
1
Wordpress Toolkit
1
PHP
1
Plesk Obsidian
1
Plesk Extension Node Js Toolkit
1
Plesk Migrator
1
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-67401 | Root-level remote code execution in WebPros cPanel is achievable by any mail-enabled account through a SQL injection flaw in the EmailTrack component. An authenticated low-privilege mailbox user can chain the injection into command execution as root, giving full server takeover; the vendor has shipped fixes across five maintenance branches and a HackerOne-sourced report confirms the issue, though no public exploit has been identified at time of analysis. | CRITICAL | 9.9 | 1.0% | 70 |
PoC
|
| CVE-2026-56843 | Cross-tenant credential disclosure in WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to enumerate domains belonging to other tenants through the XML-RPC API, because ownership checks are applied only to certain lookup filters and schema validation is skipped for legacy protocol versions. Because affected FTP credentials are stored in cleartext, an attacker retrieves another tenant's FTP password and can pivot to executing code as that tenant's system user. No public exploit has been identified at time of analysis, but the flaw was reported via HackerOne and carries a CVSS 9.9 rating. | CRITICAL | 9.9 | 0.3% | 50 |
|
| CVE-2026-58046 | SQL injection in the Plesk hosting control panel's XML-RPC API allows a remote, low-privileged authenticated user to inject crafted SQL and read arbitrary data from the Plesk database (CWE-89), which the vendor states leads to full compromise of the panel. All Plesk builds prior to 18.0.79.4 are affected, and WebPros has released a fixed version. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the very high 9.9 CVSS and scope-change to full panel takeover make this a high-priority patch. | CRITICAL | 9.9 | 0.3% | 50 |
|
| CVE-2026-65646 | Authenticated remote attackers against WebPros Plesk (versions before 18.0.79.8, and 18.0.80 through 18.0.80.3) can inject special elements into the DNS zone management functionality to read arbitrary files on the server and escalate their privileges. Because the CVSS scope is changed (S:C), a low-privileged panel user can break out of their intended boundary to compromise the underlying host with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and EPSS is low (0.29%) with SSVC exploitation status 'none', indicating no observed exploitation yet. | CRITICAL | 9.9 | 0.3% | 50 |
|
| CVE-2026-47365 | Cross-tenant privilege escalation in WebPros WordPress Toolkit prior to 6.11.0 (as bundled with cPanel & WHM) allows an authenticated low-privilege account holder to inject arguments into the wp-toolkit CLI and execute commands in the context of another tenant on the same shared server. With a CVSS of 9.9 and scope change, a single compromised hosting account can pivot to siblings on the same host. No public exploit identified at time of analysis and the CVE is not listed in CISA KEV. | CRITICAL | 9.9 | 0.1% | 50 |
|
| CVE-2026-29200 | Tenant administrators in Comet Backup 20.11.0 through 26.1.1 and 26.2.1 can impersonate any end-user account across different tenants on the same server through an insecure direct object reference (IDOR) in an API endpoint. The vulnerability enables complete cross-tenant authentication bypass in multi-tenant deployments, allowing unauthorized access to backup data, configurations, and operations of arbitrary users. With CVSS 9.9 (Critical) rating and network-accessible exploitation requiring no privileges, this represents an immediate risk to managed service providers and multi-tenant Comet Backup installations, though no active exploitation has been confirmed via CISA KEV at time of analysis. | CRITICAL | 9.9 | 0.0% | 50 |
|
| CVE-2026-48614 | Privilege escalation in the Plesk web hosting control panel lets an authenticated low-privileged user abuse an improper authorization flaw in the XML API to inject arbitrary configuration directives, achieving arbitrary file write as root and full compromise of the underlying server. Rated CVSS 9.9 with a scope change, this turns any valid panel account into root on the host; no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.3% | 50 |
|
| CVE-2026-68487 | Arbitrary file write as root in Plesk's Backup Manager lets an authenticated customer escalate to full server compromise through a path traversal (CWE-36) in the handling of an unsigned backup header. Any low-privileged Plesk customer account can write files to attacker-chosen locations with root privileges, and because Plesk is a widely deployed hosting control panel, the flaw exposes shared and reseller hosting environments to tenant-to-root escalation. No public exploit identified at time of analysis, though the vendor support advisory documents the root cause (unsigned/unvalidated backup header enabling traversal). | CRITICAL | 9.9 | 0.4% | 50 |
No patch
|
| CVE-2026-68488 | Local privilege escalation to root affects the Backup Manager component of WebPros Plesk, where a time-of-check-to-time-of-use race condition during backup restore allows an attacker to abuse insecure symlink following and take ownership of arbitrary files or directories. A low-privileged Plesk account holder who wins the race can redirect a root-executed restore operation onto attacker-chosen paths, gaining full root control of the hosting server. No public exploit is identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.2% | 50 |
No patch
|
| CVE-2026-58048 | Privilege escalation to SQL root context in cPanel (and WP Squared) occurs when the database-rename operation fails to preserve the active SQL mode, permitting a low-privileged authenticated hosting user to have SQL executed with root-level database privileges (CWE-89). This carries a CVSS 4.0 base score of 9.4 with a scope change to subsequent systems, and no public exploit has been identified at time of analysis. It is fixed in the cPanel 138 release series per the vendor advisory. | CRITICAL | 9.4 | 0.5% | 48 |
|
| CVE-2026-65639 | Root-level OS command injection in ConfigServer Security & Firewall (CSF) lets a remote attacker who controls a configured allow/deny feed inject arbitrary shell commands through the advanced-rule parser, which executes them as root. The affected code exists both in the original ConfigServer distribution and in the WebPros-maintained fork; WebPros fixed it in version 16.30. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a high-severity but not yet demonstrated-exploited issue. | CRITICAL | 9.5 | 1.6% | 48 |
|
| CVE-2026-64639 | Privilege escalation to remote code execution in Plesk (18.0.52 through 18.0.79.6, and the 18.0.80.0 branch before 18.0.80.2) lets a low-privileged panel user - a customer or reseller - abuse a flawed database cloning routine to run arbitrary code with the privileges of the database server administrator. Because Plesk multiplexes many tenants onto shared database infrastructure, this breaks tenant isolation and effectively hands a paying customer control of the shared DB admin context. No public exploit or CISA KEV listing has been identified; the vendor CVSS 4.0 score is 9.3 (Critical), though the vector's PR:N conflicts with the description's stated need for a low-privileged account. | CRITICAL | 9.3 | 0.3% | 47 |
|
| CVE-2026-67399 | We need answer JSON only. Need synthesize. Let's parse input. CVE-2026-67399: Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code. CVSS 9.3 with CVSS 4.0 vector AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N E:X etc. CWE-502. Patch available vendor. Reported by hackerone. CPE cpe:2.3:a:webpros:whmcs:*:*:*:*:*:*:*:*. Tags RCE, Deserialization, Whmcs, Webpros. ENISA EUVD ID. Affected versions. Ref vendor help, NVD. Need output fields. Product name: WHMCS. Summary: must not copy description. Need mention deserialization in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 remote code execution. Mention patch available, CVSS 9.3 critical. No KEV/POC data given, so no public exploit identified. EPSS absent? Not in input. Maybe state no EPSS data. Need avoid "A vulnerability". Start with impact verb product: "Remote code execution in WHMCS versions 9.0.0–9.0.7 and 8.0.0–8.13.6 via unsafe deserialization..." Security professionals. Mention vendor patch, hackerone report. KEV absent? Not listed; no public exploit identified. EPSS not available. include reported by hackerone maybe. Technical_context: explain deserialization of untrusted data, PHP? WHMCS is web hosting billing platform. CWE-502. CPE identifies webpros WHMCS. Root cause class. CVSS 4.0. Maybe mention unauthenticated network, no user interaction. The description says remote attackers. Need technical context educational: Deserialization converts serialized data into objects; if untrusted input reaches unserialize in PHP, magic methods can lead to code execution. WHMCS likely PHP application. CPE confirms vendor Webpros. Versions. Risk_assessment: CVSS 4.0 AV:N/AC:L/AT:N/PR:N/UI:N VC:H VI:H VA:H -> critical 9.3. No KEV, no EPSS, no POC indicated. Patch available. SSVC? exploitation status none/poc? Automatable likely yes due network low complexity no priv no UI, technical impact total. Signal contrast: high CVSS due crit | CRITICAL | 9.3 | – | 46 |
|
| CVE-2026-67394 | Privilege escalation to root in Plesk for Linux (18.0.34 up to 18.0.79.9 / 18.0.80.5) lets a customer- or reseller-level account with shell access run OS command injection (CWE-78) to take over the entire hosting server. Any tenant permitted to use - or to toggle on - their own shell access can break out of their restricted account and reach the root identity, collapsing the isolation between shared-hosting customers and the host. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the vendor rates it critical (CVSS 9.0) and has shipped fixed builds. | CRITICAL | 9.0 | 1.2% | 46 |
|
| CVE-2026-65638 | Remote code execution in ConfigServer Security & Firewall (CSF) allows an unauthenticated attacker to run arbitrary OS commands as the CSF service account through shell command injection stemming from improperly escaped request URLs. It affects the original ConfigServer distribution and the WebPros-maintained fork containing the vulnerable code, and is fixed in WebPros version 16.30. No public exploit has been identified at time of analysis, but because CSF's login-failure daemon typically runs with root-level privileges, successful exploitation grants full server control. | CRITICAL | 9.2 | 3.2% | 46 |
|