CVE-2026-65646

CriticalCVSS 9.9/10Last modified Sep 11, 2026

Description

Improper neutralization of special elements in in Plesk's DNS zone management functionality allows remote authenticated users to disclose arbitrary local files and escalate privileges.

Metrics

CVSS 3.0 9.9/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-74

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Aug 26, 2026
Last modified: Sep 11, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-656478.7Improper symlink resolution before file access in Plesk allows remote authenticated users to execute arbitrary code as root.CVE-2026-65656.4The Style Kits – Advanced Theme Styles for Elementor, Elementor Kits & Elementor Patterns plugin for WordPress is vulnerable to Stored Cross CVE-2026-656504.3Elgg before 7.0.0 does not check image dimensions to prevent denial of service via a large avatar upload.CVE-2026-656518.7temporalio/sqlparser accepts SQL containing deeply nested unary expressions and can return a correspondingly deep abstract syntax tree witho CVE-2026-656528.7github.com/temporalio/tchannel-go did not validate the one-byte checksum-type field in inbound TChannel call frames. A network peer that can CVE-2026-656538.7github.com/temporalio/tchannel-go did not reject TChannel call fragments containing checksum metadata but no length-prefixed argument chunks CVE-2026-656548.7github.com/temporalio/ringpop-go enforces configured LabelOptions limits when an application changes the local node's labels, but affected v CVE-2026-656552.3When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server o CVE-2026-656567.8Improper neutralization of special elements used in a command ('command injection') in Microsoft Office allows an unauthorized attacker to e CVE-2026-656577.8Use after free in Microsoft Office allows an unauthorized attacker to execute code locally.CVE-2026-656588.8Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.CVE-2026-65664.3The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Insecure Direct Object Reference in