Threats affecting pkg:rpm/plesk/plesk

CVE-2026-82977 is a high-severity vulnerability in WebPros Plesk Obsidian for Linux affecting the GoAccess statistics integration. It impacts versions 18.0.77 through 18.0.81.7 and 18.0.82 through 18.0.82.2. The flaw involves incorrect permission assignment that allows cross-subscription information disclosure, potentially exposing sensitive data between subscriptions.

Improper privilege management in the XML-RPC API of Plesk before 18.0.80, allows an authenticated reseller to obtain an administrative session for the root user account.