Known Vulnerabilities for products from Cpanel
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Cpanel".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-58048 json | Not Provided | 2026-07-31 | 2026-08-07 | |
| CVE-2026-58047 json | Not Provided | 2026-07-31 | 2026-08-07 | |
| CVE-2026-54420 json | Not Provided | 2026-06-14 | 2026-06-16 | |
| CVE-2026-47365 json | Not Provided | 2026-06-12 | 2026-06-12 | |
| CVE-2026-41940 json | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthentica... | Not Provided | 2026-04-29 | 2026-05-04 |
| CVE-2026-32992 json | SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the requ... | Not Provided | 2026-05-13 | 2026-08-12 |
| CVE-2026-29205 json | Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd att... | Not Provided | 2026-05-13 | 2026-08-12 |
| CVE-2026-14803 json | Not Provided | 2026-07-06 | 2026-07-06 | |
| CVE-2026-9516 json | Not Provided | 2026-06-03 | 2026-06-03 | |
| CVE-2026-9334 json | Not Provided | 2026-06-03 | 2026-06-03 | |
| CVE-2023-29489 json | An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, a... | 6.1 - MEDIUM | 2023-04-27 | 2023-05-05 |
| CVE-2021-38590 json | In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). | 5.5 - MEDIUM | 2021-08-11 | 2022-05-03 |
| CVE-2021-38589 json | In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588). | 8.1 - HIGH | 2021-08-11 | 2021-08-20 |
| CVE-2021-38588 json | In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587). | 8.1 - HIGH | 2021-08-11 | 2021-08-20 |
| CVE-2021-38587 json | In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586). | 7.5 - HIGH | 2021-08-11 | 2022-07-12 |
| CVE-2021-38586 json | In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589). | 4.4 - MEDIUM | 2021-08-11 | 2021-08-20 |
| CVE-2021-38585 json | The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585). | 7.2 - HIGH | 2021-08-11 | 2021-08-20 |
| CVE-2021-38584 json | The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585). | 7.2 - HIGH | 2021-08-11 | 2021-08-20 |
| CVE-2021-31803 json | cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581). | 6.1 - MEDIUM | 2021-04-26 | 2021-05-06 |
| CVE-2021-26267 json | cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579). | 7.5 - HIGH | 2021-01-26 | 2023-08-08 |
Known software with vulnerabilities from Cpanel
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Cpanel | Cpanel | 11.34.0 |
| Application | Cpanel | Webhost Manager | 11.34.0 |
| Application | Cpanel | Whm | 11.34.0 |