CVE-2026-65643

HighCVSS 8.8/10Last modified Oct 14, 2026

Description

Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-95

Affected software

No affected versions have been published.

Timeline

Published
Sep 1, 2026
Last modified
Oct 14, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-656447.5Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/liveCVE-2026-656454.3Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6. 8.3.8, 8.2.8, 8.1.8, and 7.10.15, the Meteor DDP methods getThreadsList anCVE-2026-656469.9Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arCVE-2026-656478.7Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.CVE-2026-65656.4The Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns plugin for WordPress is vulnerable to Stored CrossCVE-2026-656504.3Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.CVE-2026-656518.7temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree withoCVE-2026-656528.7github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that canCVE-2026-656538.7github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunksCVE-2026-656548.7github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected vCVE-2026-656552.3When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server oCVE-2026-656567.8Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to e
CVE-2026-65643: High severity, CVSS 8.8 | Vulnix