Vulnerability-Lookup

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

Full-Text Search

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CVE-2026-105476 (GCVE-0-2026-105476)

Vulnerability from nvd – Published: 2026-11-02 21:05 – Updated: 2026-11-03 04:56

Summary

Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-02 00:00 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.cpanel.net/hc/en-us/articles/4435…

Impacted products

1 product

Vendor	Product	Version
WebPros	cPanel	Affected: 0 , < 11.138.0.19 (semver) Affected: 0 , < 11.136.0.51 (semver) Affected: 0 , < 11.134.0.67 (semver) Affected: 0 , < 11.110.0.154 (semver)

Credits

Boomerang (boomerang_)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-105476",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T04:56:48.971Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cPanel",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "11.138.0.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.51",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.134.0.67",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.110.0.154",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Boomerang (boomerang_)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T21:05:16.335Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/44356595655703-Security-CVE-2026-105476-Arbitrary-File-Write-as-Root-in-cPanel-WHM-October-20th-2026"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-105476",
    "datePublished": "2026-11-02T21:05:16.335Z",
    "dateReserved": "2026-10-05T15:00:00.728Z",
    "dateUpdated": "2026-11-03T04:56:48.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105475 (GCVE-0-2026-105475)

Vulnerability from nvd – Published: 2026-11-02 21:05 – Updated: 2026-11-02 21:25

Summary

Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-02 21:22 UTC

CWE

CWE-158 - Improper Neutralization of Null Byte or NUL Character

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.cpanel.net/hc/en-us/articles/4435…

Impacted products

1 product

Vendor	Product	Version
WebPros	cPanel	Affected: 0 , < 11.138.0.19 (semver) Affected: 0 , < 11.136.0.51 (semver) Affected: 0 , < 11.134.0.67 (semver) Affected: 0 , < 11.110.0.154 (semver)

Credits

rz1027 (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105475",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T21:22:08.509417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T21:25:25.032Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cPanel",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "11.138.0.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.51",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.134.0.67",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.110.0.154",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "rz1027 (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account\u0027s calendar and contact data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-158",
              "description": "CWE-158 Improper Neutralization of Null Byte or NUL Character",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T21:05:16.277Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/44356591132439-Security-CVE-2026-105475-Unauthenticated-Access-to-Calendar-and-Contact-Data-in-cPanel-WHM-October-20th-2026"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-105475",
    "datePublished": "2026-11-02T21:05:16.277Z",
    "dateReserved": "2026-10-05T15:00:00.728Z",
    "dateUpdated": "2026-11-02T21:25:25.032Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105474 (GCVE-0-2026-105474)

Vulnerability from nvd – Published: 2026-10-15 15:27 – Updated: 2026-10-15 16:04

Summary

A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 16:04 UTC

CWE

CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.solusvm.com/hc/en-us/articles/440…

Impacted products

1 product

Vendor	Product	Version
WebPros	SolusVM 2	Affected: 0 , ≤ 2.0.0-44576 (semver)

Credits

Georgii Shutiaev

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105474",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T16:04:20.766418Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T16:04:31.618Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SolusVM 2",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThanOrEqual": "2.0.0-44576",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Georgii Shutiaev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1336",
              "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T15:27:12.966Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.solusvm.com/hc/en-us/articles/44057968061591-CVE-2026-105474-Server-Side-Template-Injection-in-SolusVM-2"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-105474",
    "datePublished": "2026-10-15T15:27:12.966Z",
    "dateReserved": "2026-10-05T15:00:00.728Z",
    "dateUpdated": "2026-10-15T16:04:31.618Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-93699 (GCVE-0-2026-93699)

Vulnerability from nvd – Published: 2026-10-08 07:38 – Updated: 2026-10-08 17:23

Summary

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 17:22 UTC

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.cpanel.net/hc/en-us/articles/4387…

Impacted products

1 product

Vendor	Product	Version
WebPros	WP Toolkit	Affected: 0 , < 6.11.4 (semver)

Credits

rz1027 (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93699",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T17:22:51.219104Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:23:05.936Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Toolkit",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "6.11.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "rz1027 (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T07:38:08.237Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/43874620756759-Security-CVE-2026-93699-Vulnerability-in-WP-Toolkit-s-Handler-September-30-2026"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-93699",
    "datePublished": "2026-10-08T07:38:08.237Z",
    "dateReserved": "2026-09-18T15:00:00.595Z",
    "dateUpdated": "2026-10-08T17:23:05.936Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-93698 (GCVE-0-2026-93698)

Vulnerability from nvd – Published: 2026-10-02 06:20 – Updated: 2026-10-02 18:14

Summary

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

Severity

9.9 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 18:14 UTC

CWE

CWE-78 - OS Command Injection

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

7 references

URL	Tags
https://hackerone.com/reports/4054291
https://support.cpanel.net/hc/en-us/articles/4384…
https://docs.cpanel.net/changelogs/138-change-log…
https://docs.cpanel.net/changelogs/136-change-log…
https://docs.cpanel.net/changelogs/134-change-log…
https://docs.cpanel.net/changelogs/110-change-log…
https://docs.wpsquared.com/changelogs/versions/ch…

Impacted products

2 products

Vendor	Product	Version
Webpros	cPanel	Affected: 0 , < 11.138.0.11 (semver) Affected: 0 , < 11.136.0.45 (semver) Affected: 0 , < 11.134.0.61 (semver) Affected: 0 , < 11.110.0.148 (semver)
Webpros	WP Squared	Affected: 0 , < 11.138.1.13 (semver)

Credits

rz1027 (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93698",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T18:14:35.329248Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T18:14:48.415Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cPanel",
          "vendor": "Webpros",
          "versions": [
            {
              "lessThan": "11.138.0.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.45",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.134.0.61",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.110.0.148",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Squared",
          "vendor": "Webpros",
          "versions": [
            {
              "lessThan": "11.138.1.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "rz1027 (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T06:20:33.663Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/4054291"
        },
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/43845931719447-Security-CVE-2026-93698-Vulnerability-in-Multilang-Adminbin-September-29-2026"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/138-change-log/#138011"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/136-change-log/#136045"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/134-change-log/#134061"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/110-change-log/#1100148"
        },
        {
          "url": "https://docs.wpsquared.com/changelogs/versions/changelog/#138113"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-93698",
    "datePublished": "2026-10-02T06:20:33.663Z",
    "dateReserved": "2026-09-18T15:00:00.595Z",
    "dateUpdated": "2026-10-02T18:14:48.415Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-93697 (GCVE-0-2026-93697)

Vulnerability from nvd – Published: 2026-10-02 06:20 – Updated: 2026-10-02 18:14

Summary

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

Severity

9 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 18:12 UTC

CWE

CWE-79 - Cross-site Scripting (XSS) - Stored

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

7 references

URL	Tags
https://hackerone.com/reports/4047787
https://support.cpanel.net/hc/en-us/articles/4384…
https://docs.cpanel.net/changelogs/138-change-log…
https://docs.cpanel.net/changelogs/136-change-log…
https://docs.cpanel.net/changelogs/134-change-log…
https://docs.cpanel.net/changelogs/110-change-log…
https://docs.wpsquared.com/changelogs/versions/ch…

Impacted products

2 products

Vendor	Product	Version
Webpros	cPanel	Affected: 0 , < 11.138.0.11 (semver) Affected: 0 , < 11.136.0.45 (semver) Affected: 0 , < 11.134.0.61 (semver) Affected: 0 , < 11.110.0.148 (semver)
Webpros	WP Squared	Affected: 0 , < 11.138.1.13 (semver)

Credits

rz1027 (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93697",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T18:12:58.690897Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T18:14:02.299Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cPanel",
          "vendor": "Webpros",
          "versions": [
            {
              "lessThan": "11.138.0.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.45",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.134.0.61",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.110.0.148",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Squared",
          "vendor": "Webpros",
          "versions": [
            {
              "lessThan": "11.138.1.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "rz1027 (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS) - Stored",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T06:20:44.084Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/4047787"
        },
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/43845930445207-Security-CVE-2026-93697-Stored-XSS-in-WHM-s-Account-Modification-Interfaces-September-29-2026"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/138-change-log/#138011"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/136-change-log/#136045"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/134-change-log/#134061"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/110-change-log/#1100148"
        },
        {
          "url": "https://docs.wpsquared.com/changelogs/versions/changelog/#138113"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-93697",
    "datePublished": "2026-10-02T06:20:44.084Z",
    "dateReserved": "2026-09-18T15:00:00.594Z",
    "dateUpdated": "2026-10-02T18:14:02.299Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-93029 (GCVE-0-2026-93029)

Vulnerability from nvd – Published: 2026-10-02 06:20 – Updated: 2026-10-02 18:12

Summary

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

Severity

9 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 18:12 UTC

CWE

CWE-79 - Cross-site Scripting (XSS) - Stored

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

7 references

URL	Tags
https://hackerone.com/reports/4047106
https://support.cpanel.net/hc/en-us/articles/4384…
https://docs.cpanel.net/changelogs/138-change-log…
https://docs.cpanel.net/changelogs/136-change-log…
https://docs.cpanel.net/changelogs/134-change-log…
https://docs.cpanel.net/changelogs/110-change-log…
https://docs.wpsquared.com/changelogs/versions/ch…

Impacted products

2 products

Vendor	Product	Version
Webpros	cPanel	Affected: 0 , < 11.138.0.11 (semver) Affected: 0 , < 11.136.0.45 (semver) Affected: 0 , < 11.134.0.61 (semver) Affected: 0 , < 11.110.0.148 (semver)
Webpros	WP Squared	Affected: 0 , < 11.138.1.13 (semver)

Credits

rz1027 (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93029",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T18:12:23.705554Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T18:12:44.517Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cPanel",
          "vendor": "Webpros",
          "versions": [
            {
              "lessThan": "11.138.0.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.45",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.134.0.61",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.110.0.148",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Squared",
          "vendor": "Webpros",
          "versions": [
            {
              "lessThan": "11.138.1.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "rz1027 (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS) - Stored",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T06:20:47.333Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/4047106"
        },
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/43845929235351-Security-CVE-2026-93029-Stored-XSS-in-WHM-s-Manage-SSL-Hosts-Interface-September-29-2026"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/138-change-log/#138011"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/136-change-log/#136045"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/134-change-log/#134061"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/110-change-log/#1100148"
        },
        {
          "url": "https://docs.wpsquared.com/changelogs/versions/changelog/#138113"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-93029",
    "datePublished": "2026-10-02T06:20:47.333Z",
    "dateReserved": "2026-09-17T15:00:00.689Z",
    "dateUpdated": "2026-10-02T18:12:44.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87900 (GCVE-0-2026-87900)

Vulnerability from nvd – Published: 2026-09-23 19:52 – Updated: 2026-09-23 20:05

Summary

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 20:05 UTC

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.cpanel.net/hc/en-us/articles/4359…

Impacted products

1 product

Vendor	Product	Version
WebPros	WP Toolkit for cPanel	Affected: 0 , ≤ 6.11.2-10794 (semver) Unaffected: 6.11.3-10850 , < 6.11.3-10850 (semver)

Credits

Ali Mustafa (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87900",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T20:05:51.395539Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T20:05:57.710Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WP Toolkit for cPanel",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThanOrEqual": "6.11.2-10794",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11.3-10850",
              "status": "unaffected",
              "version": "6.11.3-10850",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ali Mustafa (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:52:47.153Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/43597969409943"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-87900",
    "datePublished": "2026-09-23T19:52:47.153Z",
    "dateReserved": "2026-09-09T15:00:00.574Z",
    "dateUpdated": "2026-09-23T20:05:57.710Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87899 (GCVE-0-2026-87899)

Vulnerability from nvd – Published: 2026-09-23 19:52 – Updated: 2026-09-24 03:55

Summary

Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 00:00 UTC

CWE

CWE-250 - Execution with Unnecessary Privileges

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.cpanel.net/hc/en-us/articles/4359…

Impacted products

1 product

Vendor	Product	Version
WebPros	cPanel	Affected: 11.120.0.0 , < 11.134.0.57 (semver) Affected: 11.136.0.0 , < 11.136.0.41 (semver) Affected: 11.138.0.0 , < 11.138.0.8 (semver) Unaffected: 11.134.0.57 , < 11.134.0.57 (semver) Unaffected: 11.136.0.41 , < 11.136.0.41 (semver) Unaffected: 11.138.0.8 , < 11.138.0.8 (semver)

Credits

Ali Mustafa (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87899",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T03:55:45.144Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cPanel",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "11.134.0.57",
              "status": "affected",
              "version": "11.120.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.41",
              "status": "affected",
              "version": "11.136.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.138.0.8",
              "status": "affected",
              "version": "11.138.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.134.0.57",
              "status": "unaffected",
              "version": "11.134.0.57",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.41",
              "status": "unaffected",
              "version": "11.136.0.41",
              "versionType": "semver"
            },
            {
              "lessThan": "11.138.0.8",
              "status": "unaffected",
              "version": "11.138.0.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ali Mustafa (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250 Execution with Unnecessary Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:52:47.216Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/43591715125271"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-87899",
    "datePublished": "2026-09-23T19:52:47.216Z",
    "dateReserved": "2026-09-09T15:00:00.573Z",
    "dateUpdated": "2026-09-24T03:55:45.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87898 (GCVE-0-2026-87898)

Vulnerability from nvd – Published: 2026-09-23 19:52 – Updated: 2026-09-23 20:06

Summary

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 20:06 UTC

CWE

CWE-78 - OS Command Injection

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.plesk.com/hc/en-us/articles/43641…

Impacted products

1 product

Vendor	Product	Version
WebPros	Plesk extension "Site Import"	Affected: 1.6.6 , ≤ 1.12.1 (semver) Unaffected: 1.12.2 , < 1.12.2 (semver)

Credits

Ali Mustafa (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87898",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T20:06:19.972843Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T20:06:28.175Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Plesk extension \"Site Import\"",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThanOrEqual": "1.12.1",
              "status": "affected",
              "version": "1.6.6",
              "versionType": "semver"
            },
            {
              "lessThan": "1.12.2",
              "status": "unaffected",
              "version": "1.12.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ali Mustafa (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:52:47.081Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.plesk.com/hc/en-us/articles/43641151026583"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-87898",
    "datePublished": "2026-09-23T19:52:47.081Z",
    "dateReserved": "2026-09-09T15:00:00.573Z",
    "dateUpdated": "2026-09-23T20:06:28.175Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68492 (GCVE-0-2026-68492)

Vulnerability from nvd – Published: 2026-09-23 19:52 – Updated: 2026-09-24 14:28

Summary

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 14:28 UTC

CWE

CWE-426 - Untrusted Search Path

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.plesk.com/hc/en-us/articles/43644…

Impacted products

2 products

Vendor	Product	Version
WebPros	Plesk	Affected: 18.0.34 , < 18.0.80.8 (semver) Affected: 18.0.81 , < 18.0.81.1 (semver)
WebPros	Plesk extension "Plesk RESTful API"	Affected: 2.4.2 , < 2.4.7 (semver)

Credits

Ali Mustafa (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68492",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T14:28:28.100954Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T14:28:36.450Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Plesk",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "18.0.80.8",
              "status": "affected",
              "version": "18.0.34",
              "versionType": "semver"
            },
            {
              "lessThan": "18.0.81.1",
              "status": "affected",
              "version": "18.0.81",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Plesk extension \"Plesk RESTful API\"",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "2.4.7",
              "status": "affected",
              "version": "2.4.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ali Mustafa (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the \"Plesk RESTful API\" extension from 2.4.2 before 2.4.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "CWE-426 Untrusted Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:52:47.192Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.plesk.com/hc/en-us/articles/43644058632983"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-68492",
    "datePublished": "2026-09-23T19:52:47.192Z",
    "dateReserved": "2026-07-30T15:00:00.609Z",
    "dateUpdated": "2026-09-24T14:28:36.450Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68490 (GCVE-0-2026-68490)

Vulnerability from nvd – Published: 2026-09-23 19:52 – Updated: 2026-09-24 14:28

Summary

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 14:28 UTC

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.cpanel.net/hc/en-us/articles/4350…

Impacted products

1 product

Vendor	Product	Version
WebPros	cPanel	Affected: 11.120.0.0 , < 11.134.0.57 (semver) Affected: 11.136.0.0 , < 11.136.0.41 (semver) Affected: 11.138.0.0 , < 11.138.0.8 (semver) Unaffected: 11.134.0.57 , < 11.134.0.57 (semver) Unaffected: 11.136.0.41 , < 11.136.0.41 (semver) Unaffected: 11.138.0.8 , < 11.138.0.8 (semver)

Credits

Ali Mustafa (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68490",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T14:28:48.363650Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T14:28:56.203Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cPanel",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "11.134.0.57",
              "status": "affected",
              "version": "11.120.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.41",
              "status": "affected",
              "version": "11.136.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.138.0.8",
              "status": "affected",
              "version": "11.138.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.134.0.57",
              "status": "unaffected",
              "version": "11.134.0.57",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.41",
              "status": "unaffected",
              "version": "11.136.0.41",
              "versionType": "semver"
            },
            {
              "lessThan": "11.138.0.8",
              "status": "unaffected",
              "version": "11.138.0.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ali Mustafa (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:52:47.162Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/43502940099991"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-68490",
    "datePublished": "2026-09-23T19:52:47.162Z",
    "dateReserved": "2026-07-30T15:00:00.609Z",
    "dateUpdated": "2026-09-24T14:28:56.203Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68491 (GCVE-0-2026-68491)

Vulnerability from nvd – Published: 2026-09-15 20:59 – Updated: 2026-09-16 18:04

Summary

An insufficient check allowed for the overwrite of arbitrary files via a symlink.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 18:04 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

3 references

URL	Tags
https://docs.solusvm.com/en/solusvm1/release-note…
https://docs.solusvm.com/en/solusvm1/release-note…
https://support.solusvm.com/hc/en-us/articles/435…

Impacted products

1 product

Vendor	Product	Version
Webpros	SolusVM	Affected: 0 , < 1.30.15 (semver)

Credits

RackNerd

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68491",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T18:04:00.594086Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T18:04:11.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SolusVM",
          "vendor": "Webpros",
          "versions": [
            {
              "lessThan": "1.30.15",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "RackNerd"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An insufficient check allowed for the overwrite of arbitrary files via a symlink."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T20:59:50.186Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://docs.solusvm.com/en/solusvm1/release-notes/stable-branch/v1.30/#13015"
        },
        {
          "url": "https://docs.solusvm.com/en/solusvm1/release-notes/mainline-branch/v1.30/#13015"
        },
        {
          "url": "https://support.solusvm.com/hc/en-us/articles/43503583489687-CVE-2026-68491-Vulnerability-in-SolusVM-1-allows-Guest-to-Host-privilege-escalation"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-68491",
    "datePublished": "2026-09-15T20:59:50.186Z",
    "dateReserved": "2026-07-30T15:00:00.609Z",
    "dateUpdated": "2026-09-16T18:04:11.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68489 (GCVE-0-2026-68489)

Vulnerability from nvd – Published: 2026-09-14 20:53 – Updated: 2026-09-15 13:28

Summary

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 13:28 UTC

CWE

CWE-96 - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.plesk.com/hc/en-us/articles/43473…

Impacted products

2 products

Vendor	Product	Version
WebPros	Plesk extension "Ruby"	Affected: 0 , < 1.6.6 (semver)
WebPros	Plesk extension "Node.js Toolkit"	Affected: 0 , < 2.5.0 (semver)

Credits

d1n4h

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68489",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:28:42.978491Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:28:53.581Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Plesk extension \"Ruby\"",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "1.6.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Plesk extension \"Node.js Toolkit\"",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "2.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "d1n4h"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Static Code Injection in Plesk extensions \"Ruby\" before 1.6.6 and \"Node.js Toolkit\" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-96",
              "description": "CWE-96 Improper Neutralization of Directives in Statically Saved Code (\u0027Static Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T20:53:05.644Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.plesk.com/hc/en-us/articles/43473204617239"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-68489",
    "datePublished": "2026-09-14T20:53:05.644Z",
    "dateReserved": "2026-07-30T15:00:00.609Z",
    "dateUpdated": "2026-09-15T13:28:53.581Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-67399 (GCVE-0-2026-67399)

Vulnerability from nvd – Published: 2026-09-14 20:53 – Updated: 2026-09-15 13:28

Summary

Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 13:28 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://help.whmcs.com/m/125386/l/2118034-cve-202…

Impacted products

1 product

Vendor	Product	Version
WebPros	WHMCS	Affected: 9.0.0 , < 9.0.8 (semver) Affected: 8.0.0 , < 8.13.7 (semver)

Credits

azizk (@realazizk)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67399",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:28:16.542784Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:28:24.720Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WHMCS",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "9.0.8",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.13.7",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "azizk (@realazizk)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T20:53:05.620Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://help.whmcs.com/m/125386/l/2118034-cve-2026-67399-whmcs-security-update-2026-09-03"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-67399",
    "datePublished": "2026-09-14T20:53:05.620Z",
    "dateReserved": "2026-07-29T15:00:02.294Z",
    "dateUpdated": "2026-09-15T13:28:24.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105476 (GCVE-0-2026-105476)

Vulnerability from cvelistv5 – Published: 2026-11-02 21:05 – Updated: 2026-11-03 04:56

Summary

Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.

Severity

8.8 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-02 00:00 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.cpanel.net/hc/en-us/articles/4435…

Impacted products

1 product

Vendor	Product	Version
WebPros	cPanel	Affected: 0 , < 11.138.0.19 (semver) Affected: 0 , < 11.136.0.51 (semver) Affected: 0 , < 11.134.0.67 (semver) Affected: 0 , < 11.110.0.154 (semver)

Credits

Boomerang (boomerang_)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "LOW",
              "attackVector": "NETWORK",
              "availabilityImpact": "HIGH",
              "baseScore": 8.8,
              "baseSeverity": "HIGH",
              "confidentialityImpact": "HIGH",
              "integrityImpact": "HIGH",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2026-105476",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-03T04:56:48.971Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cPanel",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "11.138.0.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.51",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.134.0.67",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.110.0.154",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Boomerang (boomerang_)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T21:05:16.335Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/44356595655703-Security-CVE-2026-105476-Arbitrary-File-Write-as-Root-in-cPanel-WHM-October-20th-2026"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-105476",
    "datePublished": "2026-11-02T21:05:16.335Z",
    "dateReserved": "2026-10-05T15:00:00.728Z",
    "dateUpdated": "2026-11-03T04:56:48.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105475 (GCVE-0-2026-105475)

Vulnerability from cvelistv5 – Published: 2026-11-02 21:05 – Updated: 2026-11-02 21:25

Summary

Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-11-02 21:22 UTC

CWE

CWE-158 - Improper Neutralization of Null Byte or NUL Character

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.cpanel.net/hc/en-us/articles/4435…

Impacted products

1 product

Vendor	Product	Version
WebPros	cPanel	Affected: 0 , < 11.138.0.19 (semver) Affected: 0 , < 11.136.0.51 (semver) Affected: 0 , < 11.134.0.67 (semver) Affected: 0 , < 11.110.0.154 (semver)

Credits

rz1027 (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105475",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-11-02T21:22:08.509417Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-11-02T21:25:25.032Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cPanel",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "11.138.0.19",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.51",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.134.0.67",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.110.0.154",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "rz1027 (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account\u0027s calendar and contact data."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-158",
              "description": "CWE-158 Improper Neutralization of Null Byte or NUL Character",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-11-02T21:05:16.277Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/44356591132439-Security-CVE-2026-105475-Unauthenticated-Access-to-Calendar-and-Contact-Data-in-cPanel-WHM-October-20th-2026"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-105475",
    "datePublished": "2026-11-02T21:05:16.277Z",
    "dateReserved": "2026-10-05T15:00:00.728Z",
    "dateUpdated": "2026-11-02T21:25:25.032Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-105474 (GCVE-0-2026-105474)

Vulnerability from cvelistv5 – Published: 2026-10-15 15:27 – Updated: 2026-10-15 16:04

Summary

A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-15 16:04 UTC

CWE

CWE-1336 - Improper Neutralization of Special Elements Used in a Template Engine

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.solusvm.com/hc/en-us/articles/440…

Impacted products

1 product

Vendor	Product	Version
WebPros	SolusVM 2	Affected: 0 , ≤ 2.0.0-44576 (semver)

Credits

Georgii Shutiaev

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-105474",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-15T16:04:20.766418Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-15T16:04:31.618Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SolusVM 2",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThanOrEqual": "2.0.0-44576",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Georgii Shutiaev"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1336",
              "description": "CWE-1336 Improper Neutralization of Special Elements Used in a Template Engine",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-15T15:27:12.966Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.solusvm.com/hc/en-us/articles/44057968061591-CVE-2026-105474-Server-Side-Template-Injection-in-SolusVM-2"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-105474",
    "datePublished": "2026-10-15T15:27:12.966Z",
    "dateReserved": "2026-10-05T15:00:00.728Z",
    "dateUpdated": "2026-10-15T16:04:31.618Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-93699 (GCVE-0-2026-93699)

Vulnerability from cvelistv5 – Published: 2026-10-08 07:38 – Updated: 2026-10-08 17:23

Summary

Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.

Severity

8.5 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-08 17:22 UTC

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.cpanel.net/hc/en-us/articles/4387…

Impacted products

1 product

Vendor	Product	Version
WebPros	WP Toolkit	Affected: 0 , < 6.11.4 (semver)

Credits

rz1027 (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93699",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-08T17:22:51.219104Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-08T17:23:05.936Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WP Toolkit",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "6.11.4",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "rz1027 (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-08T07:38:08.237Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/43874620756759-Security-CVE-2026-93699-Vulnerability-in-WP-Toolkit-s-Handler-September-30-2026"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-93699",
    "datePublished": "2026-10-08T07:38:08.237Z",
    "dateReserved": "2026-09-18T15:00:00.595Z",
    "dateUpdated": "2026-10-08T17:23:05.936Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-93029 (GCVE-0-2026-93029)

Vulnerability from cvelistv5 – Published: 2026-10-02 06:20 – Updated: 2026-10-02 18:12

Summary

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.

Severity

9 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 18:12 UTC

CWE

CWE-79 - Cross-site Scripting (XSS) - Stored

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

7 references

URL	Tags
https://hackerone.com/reports/4047106
https://support.cpanel.net/hc/en-us/articles/4384…
https://docs.cpanel.net/changelogs/138-change-log…
https://docs.cpanel.net/changelogs/136-change-log…
https://docs.cpanel.net/changelogs/134-change-log…
https://docs.cpanel.net/changelogs/110-change-log…
https://docs.wpsquared.com/changelogs/versions/ch…

Impacted products

2 products

Vendor	Product	Version
Webpros	cPanel	Affected: 0 , < 11.138.0.11 (semver) Affected: 0 , < 11.136.0.45 (semver) Affected: 0 , < 11.134.0.61 (semver) Affected: 0 , < 11.110.0.148 (semver)
Webpros	WP Squared	Affected: 0 , < 11.138.1.13 (semver)

Credits

rz1027 (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93029",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T18:12:23.705554Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T18:12:44.517Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cPanel",
          "vendor": "Webpros",
          "versions": [
            {
              "lessThan": "11.138.0.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.45",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.134.0.61",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.110.0.148",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Squared",
          "vendor": "Webpros",
          "versions": [
            {
              "lessThan": "11.138.1.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "rz1027 (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS) - Stored",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T06:20:47.333Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/4047106"
        },
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/43845929235351-Security-CVE-2026-93029-Stored-XSS-in-WHM-s-Manage-SSL-Hosts-Interface-September-29-2026"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/138-change-log/#138011"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/136-change-log/#136045"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/134-change-log/#134061"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/110-change-log/#1100148"
        },
        {
          "url": "https://docs.wpsquared.com/changelogs/versions/changelog/#138113"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-93029",
    "datePublished": "2026-10-02T06:20:47.333Z",
    "dateReserved": "2026-09-17T15:00:00.689Z",
    "dateUpdated": "2026-10-02T18:12:44.517Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-93697 (GCVE-0-2026-93697)

Vulnerability from cvelistv5 – Published: 2026-10-02 06:20 – Updated: 2026-10-02 18:14

Summary

There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.

Severity

9 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 18:12 UTC

CWE

CWE-79 - Cross-site Scripting (XSS) - Stored

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

7 references

URL	Tags
https://hackerone.com/reports/4047787
https://support.cpanel.net/hc/en-us/articles/4384…
https://docs.cpanel.net/changelogs/138-change-log…
https://docs.cpanel.net/changelogs/136-change-log…
https://docs.cpanel.net/changelogs/134-change-log…
https://docs.cpanel.net/changelogs/110-change-log…
https://docs.wpsquared.com/changelogs/versions/ch…

Impacted products

2 products

Vendor	Product	Version
Webpros	cPanel	Affected: 0 , < 11.138.0.11 (semver) Affected: 0 , < 11.136.0.45 (semver) Affected: 0 , < 11.134.0.61 (semver) Affected: 0 , < 11.110.0.148 (semver)
Webpros	WP Squared	Affected: 0 , < 11.138.1.13 (semver)

Credits

rz1027 (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93697",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T18:12:58.690897Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T18:14:02.299Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cPanel",
          "vendor": "Webpros",
          "versions": [
            {
              "lessThan": "11.138.0.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.45",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.134.0.61",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.110.0.148",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Squared",
          "vendor": "Webpros",
          "versions": [
            {
              "lessThan": "11.138.1.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "rz1027 (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-79",
              "description": "CWE-79 Cross-site Scripting (XSS) - Stored",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T06:20:44.084Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/4047787"
        },
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/43845930445207-Security-CVE-2026-93697-Stored-XSS-in-WHM-s-Account-Modification-Interfaces-September-29-2026"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/138-change-log/#138011"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/136-change-log/#136045"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/134-change-log/#134061"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/110-change-log/#1100148"
        },
        {
          "url": "https://docs.wpsquared.com/changelogs/versions/changelog/#138113"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-93697",
    "datePublished": "2026-10-02T06:20:44.084Z",
    "dateReserved": "2026-09-18T15:00:00.594Z",
    "dateUpdated": "2026-10-02T18:14:02.299Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-93698 (GCVE-0-2026-93698)

Vulnerability from cvelistv5 – Published: 2026-10-02 06:20 – Updated: 2026-10-02 18:14

Summary

Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.

Severity

9.9 (Critical)


                        
                          CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-10-02 18:14 UTC

CWE

CWE-78 - OS Command Injection

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

7 references

URL	Tags
https://hackerone.com/reports/4054291
https://support.cpanel.net/hc/en-us/articles/4384…
https://docs.cpanel.net/changelogs/138-change-log…
https://docs.cpanel.net/changelogs/136-change-log…
https://docs.cpanel.net/changelogs/134-change-log…
https://docs.cpanel.net/changelogs/110-change-log…
https://docs.wpsquared.com/changelogs/versions/ch…

Impacted products

2 products

Vendor	Product	Version
Webpros	cPanel	Affected: 0 , < 11.138.0.11 (semver) Affected: 0 , < 11.136.0.45 (semver) Affected: 0 , < 11.134.0.61 (semver) Affected: 0 , < 11.110.0.148 (semver)
Webpros	WP Squared	Affected: 0 , < 11.138.1.13 (semver)

Credits

rz1027 (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-93698",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-02T18:14:35.329248Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-02T18:14:48.415Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "cPanel",
          "vendor": "Webpros",
          "versions": [
            {
              "lessThan": "11.138.0.11",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.45",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.134.0.61",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.110.0.148",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "WP Squared",
          "vendor": "Webpros",
          "versions": [
            {
              "lessThan": "11.138.1.13",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "rz1027 (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "baseScore": 9.9,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-02T06:20:33.663Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://hackerone.com/reports/4054291"
        },
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/43845931719447-Security-CVE-2026-93698-Vulnerability-in-Multilang-Adminbin-September-29-2026"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/138-change-log/#138011"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/136-change-log/#136045"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/134-change-log/#134061"
        },
        {
          "url": "https://docs.cpanel.net/changelogs/110-change-log/#1100148"
        },
        {
          "url": "https://docs.wpsquared.com/changelogs/versions/changelog/#138113"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-93698",
    "datePublished": "2026-10-02T06:20:33.663Z",
    "dateReserved": "2026-09-18T15:00:00.595Z",
    "dateUpdated": "2026-10-02T18:14:48.415Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87899 (GCVE-0-2026-87899)

Vulnerability from cvelistv5 – Published: 2026-09-23 19:52 – Updated: 2026-09-24 03:55

Summary

Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 00:00 UTC

CWE

CWE-250 - Execution with Unnecessary Privileges

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.cpanel.net/hc/en-us/articles/4359…

Impacted products

1 product

Vendor	Product	Version
WebPros	cPanel	Affected: 11.120.0.0 , < 11.134.0.57 (semver) Affected: 11.136.0.0 , < 11.136.0.41 (semver) Affected: 11.138.0.0 , < 11.138.0.8 (semver) Unaffected: 11.134.0.57 , < 11.134.0.57 (semver) Unaffected: 11.136.0.41 , < 11.136.0.41 (semver) Unaffected: 11.138.0.8 , < 11.138.0.8 (semver)

Credits

Ali Mustafa (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87899",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T03:55:45.144Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cPanel",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "11.134.0.57",
              "status": "affected",
              "version": "11.120.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.41",
              "status": "affected",
              "version": "11.136.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.138.0.8",
              "status": "affected",
              "version": "11.138.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.134.0.57",
              "status": "unaffected",
              "version": "11.134.0.57",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.41",
              "status": "unaffected",
              "version": "11.136.0.41",
              "versionType": "semver"
            },
            {
              "lessThan": "11.138.0.8",
              "status": "unaffected",
              "version": "11.138.0.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ali Mustafa (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-250",
              "description": "CWE-250 Execution with Unnecessary Privileges",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:52:47.216Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/43591715125271"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-87899",
    "datePublished": "2026-09-23T19:52:47.216Z",
    "dateReserved": "2026-09-09T15:00:00.573Z",
    "dateUpdated": "2026-09-24T03:55:45.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68492 (GCVE-0-2026-68492)

Vulnerability from cvelistv5 – Published: 2026-09-23 19:52 – Updated: 2026-09-24 14:28

Summary

An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 14:28 UTC

CWE

CWE-426 - Untrusted Search Path

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.plesk.com/hc/en-us/articles/43644…

Impacted products

2 products

Vendor	Product	Version
WebPros	Plesk	Affected: 18.0.34 , < 18.0.80.8 (semver) Affected: 18.0.81 , < 18.0.81.1 (semver)
WebPros	Plesk extension "Plesk RESTful API"	Affected: 2.4.2 , < 2.4.7 (semver)

Credits

Ali Mustafa (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68492",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T14:28:28.100954Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T14:28:36.450Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Plesk",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "18.0.80.8",
              "status": "affected",
              "version": "18.0.34",
              "versionType": "semver"
            },
            {
              "lessThan": "18.0.81.1",
              "status": "affected",
              "version": "18.0.81",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Plesk extension \"Plesk RESTful API\"",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "2.4.7",
              "status": "affected",
              "version": "2.4.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ali Mustafa (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the \"Plesk RESTful API\" extension from 2.4.2 before 2.4.7."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "CWE-426 Untrusted Search Path",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:52:47.192Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.plesk.com/hc/en-us/articles/43644058632983"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-68492",
    "datePublished": "2026-09-23T19:52:47.192Z",
    "dateReserved": "2026-07-30T15:00:00.609Z",
    "dateUpdated": "2026-09-24T14:28:36.450Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68490 (GCVE-0-2026-68490)

Vulnerability from cvelistv5 – Published: 2026-09-23 19:52 – Updated: 2026-09-24 14:28

Summary

Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-24 14:28 UTC

CWE

CWE-732 - Incorrect Permission Assignment for Critical Resource

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.cpanel.net/hc/en-us/articles/4350…

Impacted products

1 product

Vendor	Product	Version
WebPros	cPanel	Affected: 11.120.0.0 , < 11.134.0.57 (semver) Affected: 11.136.0.0 , < 11.136.0.41 (semver) Affected: 11.138.0.0 , < 11.138.0.8 (semver) Unaffected: 11.134.0.57 , < 11.134.0.57 (semver) Unaffected: 11.136.0.41 , < 11.136.0.41 (semver) Unaffected: 11.138.0.8 , < 11.138.0.8 (semver)

Credits

Ali Mustafa (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68490",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-24T14:28:48.363650Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-24T14:28:56.203Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "cPanel",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "11.134.0.57",
              "status": "affected",
              "version": "11.120.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.41",
              "status": "affected",
              "version": "11.136.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.138.0.8",
              "status": "affected",
              "version": "11.138.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "11.134.0.57",
              "status": "unaffected",
              "version": "11.134.0.57",
              "versionType": "semver"
            },
            {
              "lessThan": "11.136.0.41",
              "status": "unaffected",
              "version": "11.136.0.41",
              "versionType": "semver"
            },
            {
              "lessThan": "11.138.0.8",
              "status": "unaffected",
              "version": "11.138.0.8",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Ali Mustafa (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-732",
              "description": "CWE-732 Incorrect Permission Assignment for Critical Resource",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:52:47.162Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/43502940099991"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-68490",
    "datePublished": "2026-09-23T19:52:47.162Z",
    "dateReserved": "2026-07-30T15:00:00.609Z",
    "dateUpdated": "2026-09-24T14:28:56.203Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87900 (GCVE-0-2026-87900)

Vulnerability from cvelistv5 – Published: 2026-09-23 19:52 – Updated: 2026-09-23 20:05

Summary

Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 20:05 UTC

CWE

CWE-88 - Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.cpanel.net/hc/en-us/articles/4359…

Impacted products

1 product

Vendor	Product	Version
WebPros	WP Toolkit for cPanel	Affected: 0 , ≤ 6.11.2-10794 (semver) Unaffected: 6.11.3-10850 , < 6.11.3-10850 (semver)

Credits

Ali Mustafa (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87900",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T20:05:51.395539Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T20:05:57.710Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "WP Toolkit for cPanel",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThanOrEqual": "6.11.2-10794",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThan": "6.11.3-10850",
              "status": "unaffected",
              "version": "6.11.3-10850",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ali Mustafa (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-88",
              "description": "CWE-88 Improper Neutralization of Argument Delimiters in a Command (\u0027Argument Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:52:47.153Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.cpanel.net/hc/en-us/articles/43597969409943"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-87900",
    "datePublished": "2026-09-23T19:52:47.153Z",
    "dateReserved": "2026-09-09T15:00:00.574Z",
    "dateUpdated": "2026-09-23T20:05:57.710Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-87898 (GCVE-0-2026-87898)

Vulnerability from cvelistv5 – Published: 2026-09-23 19:52 – Updated: 2026-09-23 20:06

Summary

OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-23 20:06 UTC

CWE

CWE-78 - OS Command Injection

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.plesk.com/hc/en-us/articles/43641…

Impacted products

1 product

Vendor	Product	Version
WebPros	Plesk extension "Site Import"	Affected: 1.6.6 , ≤ 1.12.1 (semver) Unaffected: 1.12.2 , < 1.12.2 (semver)

Credits

Ali Mustafa (rz1027)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-87898",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-23T20:06:19.972843Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-23T20:06:28.175Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Plesk extension \"Site Import\"",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThanOrEqual": "1.12.1",
              "status": "affected",
              "version": "1.6.6",
              "versionType": "semver"
            },
            {
              "lessThan": "1.12.2",
              "status": "unaffected",
              "version": "1.12.2",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Ali Mustafa (rz1027)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-23T19:52:47.081Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.plesk.com/hc/en-us/articles/43641151026583"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-87898",
    "datePublished": "2026-09-23T19:52:47.081Z",
    "dateReserved": "2026-09-09T15:00:00.573Z",
    "dateUpdated": "2026-09-23T20:06:28.175Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68491 (GCVE-0-2026-68491)

Vulnerability from cvelistv5 – Published: 2026-09-15 20:59 – Updated: 2026-09-16 18:04

Summary

An insufficient check allowed for the overwrite of arbitrary files via a symlink.

Severity

9.4 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-16 18:04 UTC

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

3 references

URL	Tags
https://docs.solusvm.com/en/solusvm1/release-note…
https://docs.solusvm.com/en/solusvm1/release-note…
https://support.solusvm.com/hc/en-us/articles/435…

Impacted products

1 product

Vendor	Product	Version
Webpros	SolusVM	Affected: 0 , < 1.30.15 (semver)

Credits

RackNerd

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68491",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T18:04:00.594086Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T18:04:11.685Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "SolusVM",
          "vendor": "Webpros",
          "versions": [
            {
              "lessThan": "1.30.15",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "RackNerd"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "An insufficient check allowed for the overwrite of arbitrary files via a symlink."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59 Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-15T20:59:50.186Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://docs.solusvm.com/en/solusvm1/release-notes/stable-branch/v1.30/#13015"
        },
        {
          "url": "https://docs.solusvm.com/en/solusvm1/release-notes/mainline-branch/v1.30/#13015"
        },
        {
          "url": "https://support.solusvm.com/hc/en-us/articles/43503583489687-CVE-2026-68491-Vulnerability-in-SolusVM-1-allows-Guest-to-Host-privilege-escalation"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-68491",
    "datePublished": "2026-09-15T20:59:50.186Z",
    "dateReserved": "2026-07-30T15:00:00.609Z",
    "dateUpdated": "2026-09-16T18:04:11.685Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-68489 (GCVE-0-2026-68489)

Vulnerability from cvelistv5 – Published: 2026-09-14 20:53 – Updated: 2026-09-15 13:28

Summary

Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.

Severity

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 13:28 UTC

CWE

CWE-96 - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://support.plesk.com/hc/en-us/articles/43473…

Impacted products

2 products

Vendor	Product	Version
WebPros	Plesk extension "Ruby"	Affected: 0 , < 1.6.6 (semver)
WebPros	Plesk extension "Node.js Toolkit"	Affected: 0 , < 2.5.0 (semver)

Credits

d1n4h

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-68489",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:28:42.978491Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:28:53.581Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Plesk extension \"Ruby\"",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "1.6.6",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "unaffected",
          "product": "Plesk extension \"Node.js Toolkit\"",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "2.5.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "d1n4h"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Static Code Injection in Plesk extensions \"Ruby\" before 1.6.6 and \"Node.js Toolkit\" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-96",
              "description": "CWE-96 Improper Neutralization of Directives in Statically Saved Code (\u0027Static Code Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T20:53:05.644Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://support.plesk.com/hc/en-us/articles/43473204617239"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-68489",
    "datePublished": "2026-09-14T20:53:05.644Z",
    "dateReserved": "2026-07-30T15:00:00.609Z",
    "dateUpdated": "2026-09-15T13:28:53.581Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-67399 (GCVE-0-2026-67399)

Vulnerability from cvelistv5 – Published: 2026-09-14 20:53 – Updated: 2026-09-15 13:28

Summary

Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.

Severity

9.3 (Critical)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-15 13:28 UTC

CWE

CWE-502 - Deserialization of Untrusted Data

Assigner

hackerone CNA under the mitre root

CNA scorecard D 59/100 over 213 records in the last 180 days details

References

1 reference

URL	Tags
https://help.whmcs.com/m/125386/l/2118034-cve-202…

Impacted products

1 product

Vendor	Product	Version
WebPros	WHMCS	Affected: 9.0.0 , < 9.0.8 (semver) Affected: 8.0.0 , < 8.13.7 (semver)

Credits

azizk (@realazizk)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-67399",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-15T13:28:16.542784Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-15T13:28:24.720Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "WHMCS",
          "vendor": "WebPros",
          "versions": [
            {
              "lessThan": "9.0.8",
              "status": "affected",
              "version": "9.0.0",
              "versionType": "semver"
            },
            {
              "lessThan": "8.13.7",
              "status": "affected",
              "version": "8.0.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "azizk (@realazizk)"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-502",
              "description": "CWE-502 Deserialization of Untrusted Data",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T20:53:05.620Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "url": "https://help.whmcs.com/m/125386/l/2118034-cve-2026-67399-whmcs-security-update-2026-09-03"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2026-67399",
    "datePublished": "2026-09-14T20:53:05.620Z",
    "dateReserved": "2026-07-29T15:00:02.294Z",
    "dateUpdated": "2026-09-15T13:28:24.720Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Find a vulnerability

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.

102 vulnerabilities by WebPros

CVE-2026-105476 (GCVE-0-2026-105476)

CVE-2026-105475 (GCVE-0-2026-105475)

CVE-2026-105474 (GCVE-0-2026-105474)

CVE-2026-93699 (GCVE-0-2026-93699)

CVE-2026-93698 (GCVE-0-2026-93698)

CVE-2026-93697 (GCVE-0-2026-93697)

CVE-2026-93029 (GCVE-0-2026-93029)

CVE-2026-87900 (GCVE-0-2026-87900)

CVE-2026-87899 (GCVE-0-2026-87899)

CVE-2026-87898 (GCVE-0-2026-87898)

CVE-2026-68492 (GCVE-0-2026-68492)

CVE-2026-68490 (GCVE-0-2026-68490)

CVE-2026-68491 (GCVE-0-2026-68491)

CVE-2026-68489 (GCVE-0-2026-68489)

CVE-2026-67399 (GCVE-0-2026-67399)

CVE-2026-105476 (GCVE-0-2026-105476)

CVE-2026-105475 (GCVE-0-2026-105475)

CVE-2026-105474 (GCVE-0-2026-105474)

CVE-2026-93699 (GCVE-0-2026-93699)

CVE-2026-93029 (GCVE-0-2026-93029)

CVE-2026-93697 (GCVE-0-2026-93697)

CVE-2026-93698 (GCVE-0-2026-93698)

CVE-2026-87899 (GCVE-0-2026-87899)

CVE-2026-68492 (GCVE-0-2026-68492)

CVE-2026-68490 (GCVE-0-2026-68490)

CVE-2026-87900 (GCVE-0-2026-87900)

CVE-2026-87898 (GCVE-0-2026-87898)

CVE-2026-68491 (GCVE-0-2026-68491)

CVE-2026-68489 (GCVE-0-2026-68489)

CVE-2026-67399 (GCVE-0-2026-67399)

Find a vulnerability

Search criteria ⓘ Use this form to refine search results. Full-text search supports keyword queries with ranking and filtering. You can combine vendor, product, and sources to narrow results. Enable “Apply ordering” to sort by date instead of relevance.

102 vulnerabilities by WebPros

CVE-2026-105476 (GCVE-0-2026-105476)

CVE-2026-105475 (GCVE-0-2026-105475)

CVE-2026-105474 (GCVE-0-2026-105474)

CVE-2026-93699 (GCVE-0-2026-93699)

CVE-2026-93698 (GCVE-0-2026-93698)

CVE-2026-93697 (GCVE-0-2026-93697)

CVE-2026-93029 (GCVE-0-2026-93029)

CVE-2026-87900 (GCVE-0-2026-87900)

CVE-2026-87899 (GCVE-0-2026-87899)

CVE-2026-87898 (GCVE-0-2026-87898)

CVE-2026-68492 (GCVE-0-2026-68492)

CVE-2026-68490 (GCVE-0-2026-68490)

CVE-2026-68491 (GCVE-0-2026-68491)

CVE-2026-68489 (GCVE-0-2026-68489)

CVE-2026-67399 (GCVE-0-2026-67399)

CVE-2026-105476 (GCVE-0-2026-105476)

CVE-2026-105475 (GCVE-0-2026-105475)

CVE-2026-105474 (GCVE-0-2026-105474)

CVE-2026-93699 (GCVE-0-2026-93699)

CVE-2026-93029 (GCVE-0-2026-93029)

CVE-2026-93697 (GCVE-0-2026-93697)

CVE-2026-93698 (GCVE-0-2026-93698)

CVE-2026-87899 (GCVE-0-2026-87899)

CVE-2026-68492 (GCVE-0-2026-68492)

CVE-2026-68490 (GCVE-0-2026-68490)

CVE-2026-87900 (GCVE-0-2026-87900)

CVE-2026-87898 (GCVE-0-2026-87898)

CVE-2026-68491 (GCVE-0-2026-68491)

CVE-2026-68489 (GCVE-0-2026-68489)

CVE-2026-67399 (GCVE-0-2026-67399)

Search criteria ⓘ Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.