Security intelligence for your infrastructure.
Ubuntu Server, Windows Server, Proxmox VE, Plesk, FortiGate / FortiOS and 6 more platforms
— track vulnerabilities, critical patches and release news on a single screen. Stay a step ahead with verified, prioritised and actionable intelligence.
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
Improper neutralization of special elements in Plesk allows remote authenticated users to disclose arbitrary local files and escalate privileges.
Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.
Incorrect database cloning process in Plesk from 18.0.52 before 18.0.79.6 and 18.0.80.2 allows a low-privileged user (customer, reseller) to execute arbitrary code on behalf of the database server administrator.
An SQL injection vulnerability in Plesk Obsidian up to 18.0.80 for Linux and Windows allows an authenticated user to read arbitrary data from the panel database.
Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.
Improper neutralization in the Plesk XML-RPC API allows a remote authenticated low-privileged user to perform SQL injection and read arbitrary data from the Plesk database, leading to full compromise of the panel.
A micro-update package containing various security improvements for the panel, web server and DNS components.
Plesk contains an XPath injection vulnerability in the APS Application Catalog search functionality, where user-supplied input is interpolated into XPath queries without proper sanitization. This allows an authenticated, low-privileged user to execute arbitrary operating system commands on the server, resulting in local privilege escalation.
New micro-release; comes with PHP 8.3 handler support and updated Comodo/Atomicorp WAF rule sets.
Plesk 18.0 has Incorrect Access Control.
The Onyx series lifecycle is complete; remaining licenses are recommended to be upgraded to the Obsidian 18 line.
Google patched a high-severity privilege escalation vulnerability in the Pixel Cellular Modem tracked as CVE-2026-58704. NIST records indicate the iss...
Leaked credentials or published vulnerability notices can be turned into attacks before defenders finish triage; attackers are shortening the time fro...
Acronis reported that CVE-2026-87886 (CVSS 7.8), a local privilege escalation rooted in insecure file permissions in the Acronis Backup plugin for cPa...
Vulnerabilities and release notes for the platforms you follow, in one email every morning. You choose which platforms to track, and you can leave at any time.
Already subscribed? Manage your preferences