30
60
60
30
55
30
60
47
CVE-2026-60163: MySQL Group Replication unauthenticated remote arbitrary SQL execution
Oracle reclassified MySQL Group Replication flaw CVE-2026-60163 from Local to Adjacent Network; researcher says it enables unauthenticated remote arbitrary SQL execution.
CVE-2026-60163 in MySQL Group Replication permits an unauthenticated remote attacker to execute arbitrary SQL on the destination server. Following discussion after the July disclosure, Oracle revised the CVSS attack vector rating from 'Local' to 'Adjacent Network'. The researcher posting to oss-security clarifies that, in the extreme, the attack surface is reachable fully remotely.
55
60
60
42
55
60
42
30
47
60
30
47
60
30
47
55
60
55
42
60
60
30
30
35
New cPanel Flaw Lets a Hosting Account With Mail Privileges Run Code as Root
cPanel patched CVE-2026-67401, an SQL injection in EmailTrack letting an account with mail privileges run code as root on the server.
cPanel released an advisory on September 8 for CVE-2026-67401, an SQL injection in EmailTrack that allows an authenticated account holder with mail-related privileges to create files and execute code as root. All supported cPanel and WHM release lines (11.110, 11.134, 11.136, 11.138 and WP Squared 11.138.1.9) are affected, with fixed builds published for each. No public exploit or exploitation has been reported and the flaw is not yet in CISA's Known Exploited Vulnerabilities catalog. The advisory carries no CVSS score, and the CVE record had not been published as of September 9.
56
60
30
42
60
60
60
60