WebPros security advisory (AV26-961)
Canada's Cyber Centre urges patches for root code-execution flaws in Plesk, cPanel, and WebPros extensions.
68
Vendor
WebPros
- Mentions · 7d0
- Mentions · 30d0
- All mentions7
- First seenAug 27, 2026
- Last mentionedSep 24, 2026
Timeline
7 articles · newest firstNew cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control
cPanel patched three flaws, including a root code-execution bug any hosting account can use to seize the server.
73
WebPros security advisory (AV26-908)
Canada's Cyber Centre relays WebPros advisories for SQL injection (CVE-2026-67401) in cPanel and two ConfigServer Firewall flaws.
38
WebPros security advisory (AV26-866)
Canada's Cyber Centre relays a WebPros advisory for CVE-2026-67394, a Plesk privilege escalation flaw to root, fixed in 18.0.79.9 and 18.0.80.5.
30
WebPros security advisory (AV26-861)
Canada's Cyber Centre relayed a cPanel advisory for CVE-2026-65643, a domain parking vulnerability fixed in multiple cPanel/WHM releases; admins should update.
30
Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server
cPanel patched critical flaw CVE-2026-65643 letting authenticated hosting customers with addon or parked domain rights execute code as root and fully compromise servers.
68
WebPros security advisory (AV26-854)
Canadian Centre for Cyber Security relayed a WebPros advisory covering Plesk vulnerabilities CVE-2026-65642 and CVE-2026-65647 with fixed versions released.
32
Related CVEs
by mentions- Authenticated Privilege Escalation to Root RCE in cPanel & WHM
- Argument Injection in WP Toolkit for cPanel Allows Cross-Account File Read and RCE
- CVE-2026-65643<1%8.7Authenticated eval injection in cPanel enables root code execution
- CVE-2026-544201%8.5Symlink-Following Privilege Escalation in LiteSpeed cPanel Plugin Exploited in the Wild
- CVE-2026-67401<1%9.9Authenticated SQL Injection in cPanel EmailTrack Leads to Root RCE
- CVE-2026-58048<1%9.4Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context
- Authenticated OS Command Injection in Plesk Yields Root Code Execution
- CVE-2026-65642<1%8.6Authenticated IDOR in WebPros Plesk exposes other customers' databases
- CalDAV/CardDAV Permission Flaw in cPanel Lets Local Users Read Other Accounts' Data
- CVE-2026-58047<1%5.6HTTP Smuggling in cPanel allows potential leak of credentials
Appears with
- Canadian Centre for Cyber Securityorganization · 5
- Pleskproduct · 4
- cPanelvendor · 4
- WP Toolkitproduct · 2
- WHMproduct · 2
- cPanel & WHMproduct · 2
- cPanelproduct · 2
- WebProsorganization · 2
- Phusion Passengervendor · 1
- Canadian Centre for Cyber Securityvendor · 1
- ConfigServer Security & Firewallproduct · 1
- cPanel & WebHost Manager (WHM)product · 1
- Plesk RESTful APIproduct · 1
- ConfigServer Security & Firewallvendor · 1
- LiteSpeedvendor · 1
- Plesk Migratorproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.