https://vulnogram.org/ Most recent CVEs assigned by HackerOne (hackerone). https://vulnogram.org/seaview/icons/hackerone.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-105474 https://vulnogram.org/CVE-2026-105474 A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root. Critical Thu, 15 Oct 2026 15:27:12 GMT https://vulnogram.org/CVE-2026-93699 https://vulnogram.org/CVE-2026-93699 Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server. High Thu, 08 Oct 2026 07:38:08 GMT https://vulnogram.org/CVE-2025-64391 https://vulnogram.org/CVE-2025-64391 This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administrator installs it. Medium Wed, 07 Oct 2026 08:49:13 GMT https://vulnogram.org/CVE-2025-64392 https://vulnogram.org/CVE-2025-64392 This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link. Medium Wed, 07 Oct 2026 08:49:07 GMT https://vulnogram.org/CVE-2026-93026 https://vulnogram.org/CVE-2026-93026 This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials. Medium Wed, 07 Oct 2026 08:49:04 GMT https://vulnogram.org/CVE-2026-58068 https://vulnogram.org/CVE-2026-58068 This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system. Medium Wed, 07 Oct 2026 08:49:00 GMT https://vulnogram.org/CVE-2026-58069 https://vulnogram.org/CVE-2026-58069 This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host. High Wed, 07 Oct 2026 08:48:56 GMT https://vulnogram.org/CVE-2025-64393 https://vulnogram.org/CVE-2025-64393 This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server. Critical Wed, 07 Oct 2026 08:48:49 GMT https://vulnogram.org/CVE-2026-93029 https://vulnogram.org/CVE-2026-93029 There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface. Critical Fri, 02 Oct 2026 06:20:47 GMT https://vulnogram.org/CVE-2026-93697 https://vulnogram.org/CVE-2026-93697 There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface. Critical Fri, 02 Oct 2026 06:20:44 GMT https://vulnogram.org/CVE-2026-93698 https://vulnogram.org/CVE-2026-93698 Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin. Critical Fri, 02 Oct 2026 06:20:33 GMT https://vulnogram.org/CVE-2026-87899 https://vulnogram.org/CVE-2026-87899 Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges. Critical Wed, 23 Sep 2026 19:52:47 GMT https://vulnogram.org/CVE-2026-68492 https://vulnogram.org/CVE-2026-68492 An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrary code as root via the "Plesk RESTful API" extension from 2.4.2 before 2.4.7. High Wed, 23 Sep 2026 19:52:47 GMT https://vulnogram.org/CVE-2026-68490 https://vulnogram.org/CVE-2026-68490 Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts. High Wed, 23 Sep 2026 19:52:47 GMT https://vulnogram.org/CVE-2026-87900 https://vulnogram.org/CVE-2026-87900 Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across customer accounts. Critical Wed, 23 Sep 2026 19:52:47 GMT https://vulnogram.org/CVE-2026-87898 https://vulnogram.org/CVE-2026-87898 OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges. Critical Wed, 23 Sep 2026 19:52:47 GMT https://vulnogram.org/CVE-2026-87902 https://vulnogram.org/CVE-2026-87902 An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directories. If relevant pre-conditions for both the server and the active theme are met, this ca… High Known Exploited Network Exploitable Tue, 22 Sep 2026 16:44:15 GMT https://vulnogram.org/CVE-2026-77165 https://vulnogram.org/CVE-2026-77165 File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database. Medium Mon, 21 Sep 2026 15:25:33 GMT https://vulnogram.org/CVE-2026-77166 https://vulnogram.org/CVE-2026-77166 The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes broken and can hide other items. Low Mon, 21 Sep 2026 15:25:33 GMT https://vulnogram.org/CVE-2026-68493 https://vulnogram.org/CVE-2026-68493 After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of. Low Fri, 18 Sep 2026 01:26:04 GMT https://vulnogram.org/CVE-2026-82985 https://vulnogram.org/CVE-2026-82985 The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather than the album owner's configuration. When an album owner shares a smart album with anoth… Medium Fri, 18 Sep 2026 01:26:04 GMT https://vulnogram.org/CVE-2026-77164 https://vulnogram.org/CVE-2026-77164 Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allows local/private addresses for this request, bypassing Nextcloud's core SSRF protections. T… Medium Fri, 18 Sep 2026 01:26:04 GMT https://vulnogram.org/CVE-2026-77170 https://vulnogram.org/CVE-2026-77170 The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board. Medium Fri, 18 Sep 2026 01:26:04 GMT https://vulnogram.org/CVE-2026-82982 https://vulnogram.org/CVE-2026-82982 The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting a file whose contents changed after they reviewed it. The backend only enforced this check… Medium Fri, 18 Sep 2026 01:26:04 GMT https://vulnogram.org/CVE-2026-77169 https://vulnogram.org/CVE-2026-77169 A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators to bypass folder-level authorization controls. The workspace app enables organizations to… Medium Fri, 18 Sep 2026 01:26:04 GMT https://vulnogram.org/CVE-2026-82980 https://vulnogram.org/CVE-2026-82980 Any authenticated user can lock or unlock files they do not own by targeting absolute WebDAV paths of other users. The DAV plugin resolves files from the absolute request URI without verifying that the path segment matches the authenticated session u… Medium Fri, 18 Sep 2026 01:26:04 GMT https://vulnogram.org/CVE-2026-68491 https://vulnogram.org/CVE-2026-68491 An insufficient check allowed for the overwrite of arbitrary files via a symlink. Critical Tue, 15 Sep 2026 20:59:50 GMT https://vulnogram.org/CVE-2026-68489 https://vulnogram.org/CVE-2026-68489 Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables. High Mon, 14 Sep 2026 20:53:05 GMT https://vulnogram.org/CVE-2026-67399 https://vulnogram.org/CVE-2026-67399 Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code. Critical Mon, 14 Sep 2026 20:53:05 GMT https://vulnogram.org/CVE-2026-65639 https://vulnogram.org/CVE-2026-65639 OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to execute arbitrary commands as root, due to insufficient validation of feed-supplied rule data.… Critical Thu, 10 Sep 2026 16:24:52 GMT https://vulnogram.org/CVE-2026-68487 https://vulnogram.org/CVE-2026-68487 Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer. Critical Thu, 10 Sep 2026 16:24:52 GMT https://vulnogram.org/CVE-2026-65638 https://vulnogram.org/CVE-2026-65638 Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF service account via shell command injection. The vulnerability affects versions of the software… Critical Thu, 10 Sep 2026 16:24:52 GMT https://vulnogram.org/CVE-2026-68488 https://vulnogram.org/CVE-2026-68488 A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary file/directory ownership takeover. Critical Thu, 10 Sep 2026 16:24:52 GMT https://vulnogram.org/CVE-2026-67401 https://vulnogram.org/CVE-2026-67401 A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component Critical Wed, 09 Sep 2026 15:49:40 GMT https://vulnogram.org/CVE-2026-68484 https://vulnogram.org/CVE-2026-68484 Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, allowing authenticated low-privileged users to create administrator accounts and obtain elev… Critical Wed, 09 Sep 2026 15:49:40 GMT https://vulnogram.org/CVE-2026-67403 https://vulnogram.org/CVE-2026-67403 Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Insufficient tenant-level authorization checks allow authenticated users to access administrative resources belonging to other tenants by specifying a valid… Critical Wed, 09 Sep 2026 15:49:40 GMT https://vulnogram.org/CVE-2026-67397 https://vulnogram.org/CVE-2026-67397 Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root. High Thu, 03 Sep 2026 23:57:15 GMT https://vulnogram.org/CVE-2026-67402 https://vulnogram.org/CVE-2026-67402 An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitra… Critical Thu, 03 Sep 2026 23:57:15 GMT https://vulnogram.org/CVE-2026-67398 https://vulnogram.org/CVE-2026-67398 Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS custome… High Thu, 03 Sep 2026 23:57:15 GMT https://vulnogram.org/CVE-2026-48932 https://vulnogram.org/CVE-2026-48932 A flaw in Node.js HTTP client can cause a request desynchronization for Node.js-based forwarding proxies that rebuild outbound headers from the visible `IncomingMessage` headers while piping the original body to a reused backend connection. Node.js c… Low Tue, 01 Sep 2026 02:08:29 GMT https://vulnogram.org/CVE-2026-65643 https://vulnogram.org/CVE-2026-65643 Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root. High Tue, 01 Sep 2026 02:07:41 GMT https://vulnogram.org/CVE-2026-67394 https://vulnogram.org/CVE-2026-67394 A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before 18.0.79.9 and 18.0.80.5. The vulnerability allows a customer or reseller with shell access… Critical Tue, 01 Sep 2026 02:07:41 GMT https://vulnogram.org/CVE-2026-67395 https://vulnogram.org/CVE-2026-67395 A path traversal vulnerability exists in Sage Employee Self Service’s custom logo functionality due to improper validation of file path parameters. By leveraging directory traversal sequences and their encoded variants, an attacker may bypass directo… Medium Tue, 01 Sep 2026 02:07:41 GMT https://vulnogram.org/CVE-2026-64632 https://vulnogram.org/CVE-2026-64632 A vulnerability allowing a low-privileged user to capture the NTLM credentials of the Reporter service account. High Wed, 26 Aug 2026 21:21:41 GMT https://vulnogram.org/CVE-2026-65646 https://vulnogram.org/CVE-2026-65646 Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges. Critical Wed, 26 Aug 2026 21:21:41 GMT https://vulnogram.org/CVE-2026-65642 https://vulnogram.org/CVE-2026-65642 Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other customers' databases. High Wed, 26 Aug 2026 21:21:41 GMT https://vulnogram.org/CVE-2026-58070 https://vulnogram.org/CVE-2026-58070 A vulnerability that records guest OS processing credentials in cleartext in a support log on the guest, allowing a user with read access to that log to recover privileged account credentials. Medium Wed, 26 Aug 2026 21:21:41 GMT https://vulnogram.org/CVE-2026-65647 https://vulnogram.org/CVE-2026-65647 Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root. High Wed, 26 Aug 2026 21:21:41 GMT https://vulnogram.org/CVE-2026-65641 https://vulnogram.org/CVE-2026-65641 A vulnerability allowing an unauthenticated network attacker to coerce SMB authentication from the service account. Critical Wed, 26 Aug 2026 21:21:40 GMT https://vulnogram.org/CVE-2026-65644 https://vulnogram.org/CVE-2026-65644 Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is store… High Network Exploitable Fri, 21 Aug 2026 02:53:43 GMT