PL
Product
Plesk
14
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 10High 4Medium 0Low 0
Watch
Add Plesk to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-68487 | 9.9 | Sep 10 | Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer Affected: through 18.0.80.6; through 18.0.79.10 |
| CVE-2026-68488 | 9.9 | Sep 10 | A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership… Affected: through 18.0.80.6; through 18.0.79.10 |
| CVE-2026-65646 | 9.9 | Aug 26 | Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate… Affected: before 18.0.79.11; 18.0.80 before 18.0.80.7 |
| CVE-2026-64637 | 9.9 | Aug 7 | Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account Affected: before 18.0.80.1 |
| CVE-2026-58046 | 9.9 | Jul 30 | Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database,… Affected: before 18.0.79.4 |
| CVE-2026-56843 | 9.9 | Jul 8 | Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own, because ownership… Affected: 10.4 before 18.0.78.4 |
| CVE-2026-48614 | 9.9 | Jul 6 | An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary file write as root… Affected: before 18.0.78 |
| CVE-2026-44962 | 9.9 | May 29 | Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper… Affected: before 18.0.75.1; before 18.0.76.2 |
| CVE-2026-64639 | 9.3 | Aug 12 | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of… Affected: 18.0.52 before 18.0.79.6; 18.0.80.0 before 18.0.80.2 |
| CVE-2026-67394 | 9.0 | Sep 1 | A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and… Affected: 18.0.34 before 18.0.79.9; 18.0.80 before 18.0.80.5 |
| CVE-2026-68492 | 8.7 | Sep 23 | An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via… Affected: 18.0.34 before 18.0.80.8; 18.0.81 before 18.0.81.1 |
| CVE-2026-65642 | 8.6 | Aug 26 | Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases Affected: through 18.0.79.7; 18.0.80 before 18.0.80.4 |
| CVE-2026-67397 | 8.5 | Sep 3 | Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root Affected: before 18.0.79.9; 18.0.80 before 18.0.80.5 |
| CVE-2026-64636 | 7.7 | Aug 7 | An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database Affected: 18.0.51 before 18.0.80.1 |
Showing 14