Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,903All CVEsplus 19,118 rejected
- 375Last 24 hours2,802 in the last 7 days
- 16,790Last 30 days1,548 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 29 | 18 | 3 | 0 | 0 | 50 | 50 |
| Title | ||
|---|---|---|
| CVE-2026-105476 | Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.WebPros · cPanel | High8.8 |
| CVE-2026-105475 | Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.WebPros · cPanel | High8.7 |
| CVE-2026-105474 | A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.WebPros · SolusVM 2 | Critical9.4 |
| CVE-2026-93699 | Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.WebPros · WP Toolkit | High8.5 |
| CVE-2026-93029 | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.Webpros · cPanel | Critical9.0 |
| CVE-2026-93697 | There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.Webpros · cPanel | Critical9.0 |
| CVE-2026-93698 | Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.Webpros · cPanel | Critical9.9 |
| CVE-2026-87899 | Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.WebPros · cPanel | Critical9.4 |
| CVE-2026-68492 | An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute…WebPros · Plesk | High8.7 |
| CVE-2026-68490 | Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.WebPros · cPanel | High8.2 |
| CVE-2026-87900 | Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code…WebPros · WP Toolkit for cPanel | Critical9.4 |
| CVE-2026-87898 | OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.WebPros · Plesk extension "Site Import" | Critical9.4 |
| CVE-2026-68491 | An insufficient check allowed for the overwrite of arbitrary files via a symlink.Webpros · SolusVM | Critical9.4 |
| CVE-2026-68489 | Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as…WebPros · Plesk extension "Ruby" | High8.7 |
| CVE-2026-67399 | Deserialization of untrusted data in WHMCS 9.0.0 before 9.0.8 and 8.0.0 before 8.13.7 allows remote attackers to execute arbitrary code.WebPros · WHMCS | Critical9.3 |
| CVE-2026-65639 | OS command injection in the advanced-rule parser of ConfigServer Security & Firewall allows a remote attacker who controls a configured allow/deny feed to…WebPros · ConfigServer Security & Firewall | Critical9.5 |
| CVE-2026-68487 | Path traversal in Plesk's Backup Manager causes arbitrary file write as root by an authenticated customer.WebPros · Plesk | Critical9.9 |
| CVE-2026-65638 | Improper escaping of a request URL in ConfigServer Security & Firewall allows an unauthenticated remote attacker to execute arbitrary commands as the CSF…WebPros · ConfigServer Security & Firewall | Critical9.2 |
| CVE-2026-68488 | A Time-of-check Time-of-use (TOCTOU) race condition leading to insecure symlink following in Plesk causes local privilege escalation to root via arbitrary…WebPros · Plesk | Critical9.9 |
| CVE-2026-67401 | A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack componentWebPros · cPanel | Critical9.9 |
| CVE-2026-67397 | Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.WebPros · Plesk | High8.5 |
| CVE-2026-67402 | An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote…WebPros · ConfigServer Security & Firewall | Critical9.2 |
| CVE-2026-67398 | Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL…WebPros · WHMCS | High8.2 |
| CVE-2026-65643 | Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.WebPros · cPanel | High8.7 |
| CVE-2026-67394 | A critical local privilege escalation via OS command injection vulnerability has been discovered in Plesk for Linux, affecting all versions from 18.0.34 before…WebPros · Plesk | Critical9.0 |
| CVE-2026-65646 | Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files…WebPros · Plesk | Critical9.9 |
| CVE-2026-65642 | Insecure direct object reference in Plesk 18.0.79.7 and earlier or 18.0.80 through 18.0.80.3, allows remote authenticated users to read and modify other…WebPros · Plesk | High8.6 |
| CVE-2026-65647 | Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.WebPros · Plesk Migrator | High8.7 |
| CVE-2026-64639 | Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary…WebPros · Plesk | Critical9.3 |
| CVE-2026-64637 | Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root…WebPros · Plesk | Critical9.9 |
| CVE-2026-64636 | An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel…WebPros · Plesk | High7.7 |
| CVE-2026-58048 | Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context.WebPros · cPanel | Critical9.4 |
| CVE-2026-58047 | HTTP Smuggling in cPanel allows potential leak of credentials.WebPros · cPanel | Medium5.6 |
| CVE-2026-58046 | Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the…WebPros · Plesk | Critical9.9 |
| CVE-2026-56843 | Incorrect authorization in the XML-RPC API of WebPros Plesk before 18.0.78.4 allows a low-privileged authenticated customer to look up domains they do not own,…Webpros · Plesk | Critical9.9 |
| CVE-2026-48614 | An improper authorization vulnerability in the Plesk XML API allows an authenticated user to inject arbitrary configuration directives, resulting in arbitrary…WebPros · Plesk | Critical9.9 |
| CVE-2026-47365 | Argument injection vulnerability in WordPress Toolkit before 6.11.0 as used in cPanel & WHM, allows remote authenticated users to bypass cross-tenant…WebPros · WordPress-Toolkit | Critical9.9 |
| CVE-2026-44962 | Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath…WebPros · Plesk | Critical9.9 |
| CVE-2026-32999 | Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute an arbitrary code…WebPros · Comet Backup | Critical9.1 |
| CVE-2026-29206 | Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled.WebPros · cPanel | High8.1 |
| CVE-2026-32991 | Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account.WebPros · cPanel | High7.1 |
| CVE-2026-29205 | Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.WebPros · cPanel | High8.6 |
| CVE-2026-32992 | SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.WebPros · cPanel | High8.2 |
| CVE-2026-32993 | Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header…WebPros · cPanel | High8.3 |
| CVE-2026-29204 | Insufficient ownership check in `clientarea.php` allows an authenticated client area user to submit requests using another user’s `addonId` without any…WebPros · WHMCS | Critical9.1 |
| CVE-2026-29201 | Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is…WebPros · cPanel | High8.6 |
| CVE-2026-29202 | Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated…WebPros · cPanel | Medium5.3 |
| CVE-2026-29203 | A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories.…WebPros · cPanel | Medium5.3 |
| CVE-2026-29200 | A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant…WebPros · Comet Backup | Critical9.9 |
| CVE-2026-41940 | WebPros cPanel and WHM Authentication Bypass via Login FlowExploitedWebPros · cPanel | Critical9.3 |