Browse CVEs

HIGH 8.2 CVE-2026-32992 SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credenti… Wp Squared 126.0.59 / 130.0.23+ Fix from $1,9502026-05-13 HIGH 8.6 CVE-2026-29205EPSS 8% Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoin… Wp Squared 124.0.38 / 126.0.59+ Fix from $1,9502026-05-13 CRITICAL 9.8 CVE-2026-41940 KEVEPSS 98% cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to … Wp Squared 86.0.41 / 110.0.97+ Fix from $2,3002026-04-29 HIGH 8.8 CVE-2025-66429 An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitra… Cpanel 126.0.37 / 130.0.16+ Fix from $1,9502025-12-11 MEDIUM 6.1 CVE-2023-29489EPSS 66% An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed ve… Cpanel 11.102.0.31 / 11.106.0.18+ Fix from $1,6002023-04-27 HIGH 8.1 CVE-2021-38588 In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587). Cpanel 96.0.13+ Fix from $1,9502021-08-11 HIGH 8.1 CVE-2021-38589 In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588). Cpanel 11.96.0.13+ Fix from $1,9502021-08-11 HIGH 7.5 CVE-2021-38587 In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586). Cpanel 96.0.13+ Fix from $1,9502021-08-11 HIGH 7.2 CVE-2021-38584 The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585). Cpanel 98.0.1+ Fix from $1,9502021-08-11 HIGH 7.2 CVE-2021-38585 The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585). Cpanel 98.0.1+ Fix from $1,9502021-08-11 MEDIUM 5.5 CVE-2021-38590 In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). Cpanel 11.98.0.8+ Fix from $1,6002021-08-11 MEDIUM 6.1 CVE-2021-31803 cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581). Cpanel 94.0.3+ Fix from $1,6002021-04-26 HIGH 7.5 CVE-2021-26266 cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578). Cpanel 92.0.9+ Fix from $1,9502021-01-26 HIGH 7.5 CVE-2021-26267 cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579). Cpanel 92.0.9+ Fix from $1,9502021-01-26 MEDIUM 6.5 CVE-2020-29136 In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575). Cpanel 11.86.0.32 / 11.90.0.17+ Fix from $1,6002020-11-27 MEDIUM 6.1 CVE-2020-29137 cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577). Cpanel 90.0.17+ Fix from $1,6002020-11-27 CRITICAL 9.8 CVE-2020-26105 In cPanel before 88.0.3, insecure chkservd test credentials are used on a templated VM (SEC-554). Cpanel 88.0.3+ Fix from $2,3002020-09-25 CRITICAL 9.8 CVE-2020-26108 cPanel before 88.0.13 mishandles file-extension dispatching, leading to code execution (SEC-488). Cpanel 88.0.13+ Fix from $2,3002020-09-25 HIGH 7.5 CVE-2020-26103 In cPanel before 88.0.3, an insecure site password is used for Mailman on a templated VM (SEC-551). Cpanel 88.0.3+ Fix from $1,9502020-09-25 HIGH 7.5 CVE-2020-26104 In cPanel before 88.0.3, an insecure SRS secret is used on a templated VM (SEC-552). Cpanel 88.0.3+ Fix from $1,9502020-09-25 HIGH 7.5 CVE-2020-26106 cPanel before 88.0.3 has weak permissions (world readable) for the proxy subdomains log file (SEC-558). Cpanel 88.0.3+ Fix from $1,9502020-09-25 HIGH 7.5 CVE-2020-26107 cPanel before 88.0.3, upon an upgrade, establishes predictable PowerDNS API keys (SEC-561). Cpanel 88.0.3+ Fix from $1,9502020-09-25 HIGH 7.5 CVE-2020-26109 cPanel before 88.0.13 allows bypass of a protection mechanism that attempted to restrict package modification (SEC-557). Cpanel 88.0.3+ Fix from $1,9502020-09-25 HIGH 7.5 CVE-2020-26112 The email quota cache in cPanel before 90.0.10 allows overwriting of files. Cpanel 90.0.10+ Fix from $1,9502020-09-25 MEDIUM 6.1 CVE-2020-26110 cPanel before 88.0.13 allows self XSS via DNS Zone Manager DNSSEC interfaces (SEC-564). Cpanel 88.0.13+ Fix from $1,6002020-09-25 MEDIUM 6.1 CVE-2020-26111 cPanel before 90.0.10 allows self XSS via the WHM Edit DNS Zone interface (SEC-566). Cpanel 90.0.10+ Fix from $1,6002020-09-25 MEDIUM 6.1 CVE-2020-26113 cPanel before 90.0.10 allows self XSS via WHM Manage API Tokens interfaces (SEC-569). Cpanel 90.0.10+ Fix from $1,6002020-09-25 MEDIUM 6.1 CVE-2020-26114 cPanel before 90.0.10 allows self XSS via the Cron Jobs interface (SEC-573). Cpanel 90.0.10+ Fix from $1,6002020-09-25 MEDIUM 6.1 CVE-2020-26115 cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574). Cpanel 90.0.10+ Fix from $1,6002020-09-25 CRITICAL 9.8 CVE-2020-26098 cPanel before 88.0.3 mishandles the Exim filter path, leading to remote code execution (SEC-485). Cpanel 88.0.3+ Fix from $2,3002020-09-25