EUVD-2026-70851

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...

CVE-2026-67397

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...

CVE-2026-67397

Plesk for Linux versions 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 are affected by a path traversal vulnerability (CVE-2026-67397) that allows local users with low privileges to execute arbitrary code as root . The vulnerability requires local access with low privileges and no user inte...

CVE-2026-67397

Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root...

PT-2026-85033

Name of the Vulnerable Software and Affected Versions Plesk versions 18.0.79.9 and earlier Plesk versions 18.0.80 through 18.0.80.5 Description A path traversal issue allows local users to execute arbitrary code with root privileges. Path traversal is a flaw that allows an attacker to access file...

CVE-2026-67394

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access or allowed to change their own shell access to...

CVE-2026-67394

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access or allowed to change their own shell access to...

CVE-2026-67394

Plesk for Linux versions 18.0.34 through before 18.0.79.9 and 18.0.80.5 are affected by a critical local privilege escalation via OS command injection (CVSS 4.0: 9.0). An attacker who already has shell access (or is allowed to change their own shell) can escalate to the root account on the hostin...

EUVD-2026-68921

A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access or allowed to change their own shell access to...

CVE-2026-65646

A flaw was found in Plesk. Improper neutralization of special elements allows remote authenticated users to disclose arbitrary local files. This vulnerability can also lead to privilege escalation within the system...

CVE-2026-65642

A flaw was found in Plesk. This vulnerability, known as an Insecure Direct Object Reference IDOR, allows remote authenticated users to bypass authorization checks. An attacker can exploit this to read and modify other customers' databases, leading to unauthorized information disclosure and data...

PT-2026-83114

Name of the Vulnerable Software and Affected Versions Plesk for Linux versions 18.0.34 through 18.0.79.8 Description A local privilege escalation issue exists due to OS command injection. This allows a customer or reseller with shell access, or the ability to modify their own shell access, to...

EUVD-2026-66763

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...

EUVD-2026-66764

Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges...

EUVD-2026-66761

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...

CVE-2026-65646

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges...

CVE-2026-65647

Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root...

CVE-2026-65642

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...

CVE-2026-65646

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges...

CVE-2026-65642

Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases...