16
CVEs
12
Critical
3
High
0
KEV
1
PoC
2
Unpatched C/H
87.5%
Patch Rate
0.7%
Avg EPSS
Severity Breakdown
CRITICAL
12
HIGH
3
MEDIUM
1
LOW
0
Monthly CVE Trend
Affected Products (13)
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-67401 | Root-level remote code execution in WebPros cPanel is achievable by any mail-enabled account through a SQL injection flaw in the EmailTrack component. An authenticated low-privilege mailbox user can chain the injection into command execution as root, giving full server takeover; the vendor has shipped fixes across five maintenance branches and a HackerOne-sourced report confirms the issue, though no public exploit has been identified at time of analysis. | CRITICAL | 9.9 | 1.0% | 70 |
PoC
|
| CVE-2026-56843 | Cross-tenant credential disclosure in WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to enumerate domains belonging to other tenants through the XML-RPC API, because ownership checks are applied only to certain lookup filters and schema validation is skipped for legacy protocol versions. Because affected FTP credentials are stored in cleartext, an attacker retrieves another tenant's FTP password and can pivot to executing code as that tenant's system user. No public exploit has been identified at time of analysis, but the flaw was reported via HackerOne and carries a CVSS 9.9 rating. | CRITICAL | 9.9 | 0.3% | 50 |
|
| CVE-2026-58046 | SQL injection in the Plesk hosting control panel's XML-RPC API allows a remote, low-privileged authenticated user to inject crafted SQL and read arbitrary data from the Plesk database (CWE-89), which the vendor states leads to full compromise of the panel. All Plesk builds prior to 18.0.79.4 are affected, and WebPros has released a fixed version. There is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV, but the very high 9.9 CVSS and scope-change to full panel takeover make this a high-priority patch. | CRITICAL | 9.9 | 0.3% | 50 |
|
| CVE-2026-65646 | Authenticated remote attackers against WebPros Plesk (versions before 18.0.79.8, and 18.0.80 through 18.0.80.3) can inject special elements into the DNS zone management functionality to read arbitrary files on the server and escalate their privileges. Because the CVSS scope is changed (S:C), a low-privileged panel user can break out of their intended boundary to compromise the underlying host with full confidentiality, integrity, and availability impact. No public exploit is identified at time of analysis, and EPSS is low (0.29%) with SSVC exploitation status 'none', indicating no observed exploitation yet. | CRITICAL | 9.9 | 0.3% | 50 |
|
| CVE-2026-48614 | Privilege escalation in the Plesk web hosting control panel lets an authenticated low-privileged user abuse an improper authorization flaw in the XML API to inject arbitrary configuration directives, achieving arbitrary file write as root and full compromise of the underlying server. Rated CVSS 9.9 with a scope change, this turns any valid panel account into root on the host; no public exploit identified at time of analysis and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.3% | 50 |
|
| CVE-2026-68487 | Arbitrary file write as root in Plesk's Backup Manager lets an authenticated customer escalate to full server compromise through a path traversal (CWE-36) in the handling of an unsigned backup header. Any low-privileged Plesk customer account can write files to attacker-chosen locations with root privileges, and because Plesk is a widely deployed hosting control panel, the flaw exposes shared and reseller hosting environments to tenant-to-root escalation. No public exploit identified at time of analysis, though the vendor support advisory documents the root cause (unsigned/unvalidated backup header enabling traversal). | CRITICAL | 9.9 | 0.4% | 50 |
No patch
|
| CVE-2026-68488 | Local privilege escalation to root affects the Backup Manager component of WebPros Plesk, where a time-of-check-to-time-of-use race condition during backup restore allows an attacker to abuse insecure symlink following and take ownership of arbitrary files or directories. A low-privileged Plesk account holder who wins the race can redirect a root-executed restore operation onto attacker-chosen paths, gaining full root control of the hosting server. No public exploit is identified at time of analysis, and it is not listed in CISA KEV. | CRITICAL | 9.9 | 0.2% | 50 |
No patch
|
| CVE-2026-58048 | Privilege escalation to SQL root context in cPanel (and WP Squared) occurs when the database-rename operation fails to preserve the active SQL mode, permitting a low-privileged authenticated hosting user to have SQL executed with root-level database privileges (CWE-89). This carries a CVSS 4.0 base score of 9.4 with a scope change to subsequent systems, and no public exploit has been identified at time of analysis. It is fixed in the cPanel 138 release series per the vendor advisory. | CRITICAL | 9.4 | 0.5% | 48 |
|
| CVE-2026-65639 | Root-level OS command injection in ConfigServer Security & Firewall (CSF) lets a remote attacker who controls a configured allow/deny feed inject arbitrary shell commands through the advanced-rule parser, which executes them as root. The affected code exists both in the original ConfigServer distribution and in the WebPros-maintained fork; WebPros fixed it in version 16.30. There is no public exploit identified at time of analysis and no CISA KEV listing, so this is a high-severity but not yet demonstrated-exploited issue. | CRITICAL | 9.5 | 1.6% | 48 |
|
| CVE-2026-64639 | Privilege escalation to remote code execution in Plesk (18.0.52 through 18.0.79.6, and the 18.0.80.0 branch before 18.0.80.2) lets a low-privileged panel user - a customer or reseller - abuse a flawed database cloning routine to run arbitrary code with the privileges of the database server administrator. Because Plesk multiplexes many tenants onto shared database infrastructure, this breaks tenant isolation and effectively hands a paying customer control of the shared DB admin context. No public exploit or CISA KEV listing has been identified; the vendor CVSS 4.0 score is 9.3 (Critical), though the vector's PR:N conflicts with the description's stated need for a low-privileged account. | CRITICAL | 9.3 | 0.3% | 47 |
|
| CVE-2026-67394 | Privilege escalation to root in Plesk for Linux (18.0.34 up to 18.0.79.9 / 18.0.80.5) lets a customer- or reseller-level account with shell access run OS command injection (CWE-78) to take over the entire hosting server. Any tenant permitted to use - or to toggle on - their own shell access can break out of their restricted account and reach the root identity, collapsing the isolation between shared-hosting customers and the host. No public exploit has been identified at time of analysis and it is not listed in CISA KEV, but the vendor rates it critical (CVSS 9.0) and has shipped fixed builds. | CRITICAL | 9.0 | 1.2% | 46 |
|
| CVE-2026-65638 | Remote code execution in ConfigServer Security & Firewall (CSF) allows an unauthenticated attacker to run arbitrary OS commands as the CSF service account through shell command injection stemming from improperly escaped request URLs. It affects the original ConfigServer distribution and the WebPros-maintained fork containing the vulnerable code, and is fixed in WebPros version 16.30. No public exploit has been identified at time of analysis, but because CSF's login-failure daemon typically runs with root-level privileges, successful exploitation grants full server control. | CRITICAL | 9.2 | 3.2% | 46 |
|
| CVE-2026-65643 | Eval injection in cPanel's Park API (versions 11.138.0.0 and earlier) enables remote authenticated users to execute arbitrary code with root-level privileges on affected hosting servers. The vulnerability, classified under CWE-95 (Eval Injection) and reported via HackerOne, was disclosed alongside a WebPros vendor advisory on August 27, 2026. No public exploit code or CISA KEV listing has been identified at time of analysis, though the direct path to root execution across a widely deployed hosting platform makes this a critical remediation priority. | HIGH | 8.7 | 0.6% | 44 |
|
| CVE-2026-65647 | Remote code execution via symlink following in Plesk's Site Import and Migrator extensions allows network-accessible, low-privilege authenticated users to execute arbitrary code as root on the hosting server. Both webpros:plesk_migrator and webpros:plesk_site_import are affected across all versions per CPE wildcard data, with the flaw rooted in CWE-59 improper link resolution during privileged file operations. No public exploit or active exploitation is confirmed at time of analysis, but the low-complexity, network-accessible attack path and root-level impact make this a high-priority remediation target for Plesk hosting environments. | HIGH | 8.7 | 0.5% | 44 |
|
| CVE-2026-65642 | Cross-tenant insecure direct object reference in Plesk's database management interface allows any authenticated hosting panel customer to read and overwrite databases belonging to other customers on the same server, affecting versions 18.0.79.7 and earlier and 18.0.80 through 18.0.80.3. The CVSS 4.0 score of 8.6 reflects high confidentiality and integrity impact with low attack complexity, consistent with the description: a valid tenant account and knowledge of another tenant's database identifier are all that is required. No public exploit code or CISA KEV listing has been identified at time of analysis, but the multi-tenant hosting context amplifies real-world impact significantly. | HIGH | 8.6 | 0.4% | 43 |
|