Webpros Plesk vulnerabilities

• webpros plesk extension "site import" OS command injection in Plesk allows remote authenticated users to execute arbitrary code with... CVE-2026-87898 9.4 CriticalSeptember 23, 2026
• plesk, webpros plesk extension "plesk restful api" +1 more An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before... CVE-2026-68492 8.7 HighSeptember 23, 2026
• webpros plesk extension "node.js toolkit", plesk extension "ruby" +1 more Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0... CVE-2026-68489 8.7 HighSeptember 14, 2026
• plesk A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in... CVE-2026-68488 9.9 CriticalSeptember 10, 2026
• plesk Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated... CVE-2026-68487 9.9 CriticalSeptember 10, 2026
• plesk Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to... CVE-2026-67397 8.5 HighSeptember 3, 2026
• plesk A critical local privilege escalation via OS command injection vulnerability has been discovered... CVE-2026-67394 9.0 CriticalSeptember 1, 2026
• webpros plesk migrator, plesk site import +1 more Improper symlink resolution before file access in Plesk allows remote authenticated users to... CVE-2026-65647 Public exploit 8.7 HighAugust 26, 2026
• plesk Improper neutralization of special elements in Plesk allows remote authenticated users to... CVE-2026-65646 9.9 CriticalAugust 26, 2026
• plesk Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3,... CVE-2026-65642 8.6 HighAugust 26, 2026
• plesk Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a... CVE-2026-64639 9.3 CriticalAugust 12, 2026
• plesk Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated... CVE-2026-64637 9.9 CriticalAugust 7, 2026
• plesk An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an... CVE-2026-64636 7.7 HighAugust 7, 2026
• plesk Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged... CVE-2026-58046 9.9 CriticalJuly 30, 2026
• plesk Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low... CVE-2026-56843 9.9 CriticalJuly 8, 2026
• plesk An improper authorization vulnerability in the Plesk XML API allows an authenticated user to... CVE-2026-48614 9.9 CriticalJuly 6, 2026
• plesk Plesk contains an XPath injection vulnerability in the APS Application Catalog search... CVE-2026-44962 9.9 CriticalMay 29, 2026
• webpros plesk obsidian, red hat openshift dev spaces +1 more Plesk Obsidian versions 8.0.1 through 18.0.73 are vulnerable to a Denial of Service (DoS)... CVE-2025-65518 Public exploit 7.5 HighJanuary 8, 2026