hackerone

Latest CVEs · RSS

• CVE-2026-105474 2026-10-15 · CVSS 9.4
  A server-side template injection exists in SolusVM 2 up to version 2.0.0-44576 that allows remote authenticated users to execute arbitrary code as root.
• CVE-2026-93699 2026-10-08 · CVSS 8.5
  Argument injection in WP Toolkit for cPanel allows local users to execute arbitrary code as other accounts on the same server.
• CVE-2025-64391 2026-10-07 · CVSS 4.1
  This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write files to arbitrary locations when an administ
• CVE-2025-64392 2026-10-07 · CVSS 4.8
  This vulnerability in Veeam Backup Enterprise Manager allows an attacker to execute script in the browser of a portal user who opens a crafted link.
• CVE-2026-93026 2026-10-07 · CVSS 6.1
  This vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise Manager master key and stored antivirus update credentials.
• CVE-2026-58068 2026-10-07 · CVSS 6.8
  This vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate arbitrary processes on the system.
• CVE-2026-58069 2026-10-07 · CVSS 8.3
  This vulnerability in Veeam Backup & Replication allows an authenticated Cloud Connect tenant to read arbitrary files on the service provider host.
• CVE-2025-64393 2026-10-07 · CVSS 9.4
  This vulnerability in Veeam Backup & Replication allows a Backup Viewer to execute arbitrary code as SYSTEM on the backup server.
• CVE-2026-93029 2026-10-02 · CVSS 9.0
  There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface.
• CVE-2026-93697 2026-10-02 · CVSS 9.0
  There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface.
• CVE-2026-93698 2026-10-02 · CVSS 9.9
  Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin.
• CVE-2026-87899 2026-09-23 · CVSS 9.4
  Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges.
• CVE-2026-68492 2026-09-23 · CVSS 8.7
  An untrusted search path vulnerability in Plesk from 18.0.34 before 18.0.80.8 and 18.0.81 before 18.0.81.1 allows remote authenticated users to execute arbitrar
• CVE-2026-68490 2026-09-23 · CVSS 8.2
  Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts.
• CVE-2026-87900 2026-09-23 · CVSS 9.4
  Argument injection in WP Toolkit for cPanel 6.11.2-10794 and earlier allows remote authenticated users to read arbitrary files and execute arbitrary code across
• CVE-2026-87898 2026-09-23 · CVSS 9.4
  OS command injection in Plesk allows remote authenticated users to execute arbitrary code with root privileges.
• CVE-2026-87902 2026-09-22
  An unauthenticated attacker can make `get_page_template()` page-template resolution include a chosen readable local `.php` file outside the active theme directo
• CVE-2026-77165 2026-09-21 · CVSS 6.5
  File owners were unable to unlock TYPE_TOKEN locks placed by other users, leaving files permanently locked with no recovery path outside of the database.
• CVE-2026-77166 2026-09-21 · CVSS 2.4
  The emoji field in the page emoji update endpoint does not properly validate user input. By injecting long text and line breaks, the sidebar layout becomes brok
• CVE-2026-68493 2026-09-18 · CVSS 3.1
  After guessing a 62^15 complex unique identifier, a malicious logged in user was able to retrieve a list of memberships for a circle they are not a member of.
• CVE-2026-77164 2026-09-18 · CVSS 6.2
  Circles' remote-instance signature verification fetches the attacker-supplied keyId URL before trust in the remote instance is established, and explicitly allow
• CVE-2026-82985 2026-09-18 · CVSS 6.5
  The Photos app's filter-based "smart albums" build their file listing using the search configuration (photosSourceFolders) of the user viewing the album, rather
• CVE-2026-77170 2026-09-18 · CVSS 4.3
  The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has pe
• CVE-2026-82982 2026-09-18 · CVSS 4.3
  The Approval app's approve/reject endpoint is meant to require the file's current etag as a freshness check, preventing an approver from approving or rejecting
• CVE-2026-77169 2026-09-18 · CVSS 6.5
  A vulnerability in the team folders (formerly group folders) app when used in combination with the workspace app allowed API/REST-only delegated administrators