CVE-2026-68489
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execut
CVSS
—
Sem CVSS
EPSS
0.7%
p52
KEV
—
Exploit Today
16
0-100
Publicado: 14 de set. de 2026 · Última mod.: 18 de set. de 2026 · CWE-96
0.7%EPSS · 30 dias0.7%
2026-10-082026-11-05
Static Code Injection in Plesk extensions "Ruby" before 1.6.6 and "Node.js Toolkit" before 2.5.0 allows remote authenticated users to execute arbitrary code as root via custom environment variables.
CVECVSSEPSSKEVRExploitTítuloMod.
CVE-2026-108121—23.9%
——7Brian Mariani from DigitalCanion SA has discovered a vulnerability in the domain creation functionality of koozali's
SME Server version 11.0rc1-215, allowing an attacker with high privileges
to inject reserved Apache configuration directives, corrupting
httpd.conf and preventing Apache from starting after a server reboot,
resulting in a denial-of-service (DoS) condition affecting the web
server and its hosted virtual hosts.17dCVE-2026-854757.2 ALT56.6%
——17A flaw was found in the Ansible Automation Platform automation controller. The
external logging (rsyslog) configuration is generated by interpolating
user-controlled settings — LOG_AGGREGATOR_HOST, LOG_AGGREGATOR_MAX_DISK_USAGE_PATH
and LOG_AGGREGATOR_RSYSLOGD_ERROR_LOG_FILE — into an rsyslog RainerScript config
file without neutralizing RainerScript syntax. A privileged (superuser) user can
inject rsyslog directives, including an omprog action, causing arbitrary command
execution inside the control-plane rsyslog component. This allows disclosure of
the controller SECRET_KEY and database credentials, decryption of all stored
credentials, and full compromise of the control plane.21dCVE-2026-862189.8 CRÍ96.8%
KEV—79N-able N-central Static Code Injection Vulnerability58dCVE-2025-78256.3 MÉD19.3%
——6The Schema Plugin For Divi, Gutenberg & Shortcodes plugin for WordPress is vulnerable to Object Instantiation in all versions up to, and including, 4.3.2 via deserialization of untrusted input via the wpt_schema_breadcrumbs shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software, which means this vulnerability has no impact unless another plugin or theme containing a POP chain is installed on the site. If a POP chain is present via an additional plugin or theme installed on the target system, it may allow the attacker to perform actions like delete arbitrary files, retrieve sensitive data, or execute code depending on the POP chain present.24d