Known Vulnerabilities for products from Cpanel
Listed below are 20 of the newest known vulnerabilities associated with the vendor "Cpanel".
These CVEs are retrieved based on exact matches on listed vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed vendor information are still displayed.
Data on known vulnerable products is also displayed based on information from known CPEs, each product links to its respective vulnerability page.
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-104586 json | Not Provided | 2026-10-15 | 2026-10-15 | |
| CVE-2026-93699 json | Not Provided | 2026-10-08 | 2026-10-08 | |
| CVE-2026-87900 json | Not Provided | 2026-09-23 | 2026-09-23 | |
| CVE-2026-87899 json | Not Provided | 2026-09-23 | 2026-09-24 | |
| CVE-2026-87886 json | Not Provided | 2026-09-17 | 2026-09-18 | |
| CVE-2026-67401 json | Not Provided | 2026-09-09 | 2026-09-10 | |
| CVE-2026-65643 json | Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root. | Not Provided | 2026-09-01 | 2026-10-14 |
| CVE-2026-58048 json | Not Provided | 2026-07-31 | 2026-08-07 | |
| CVE-2026-58047 json | Not Provided | 2026-07-31 | 2026-08-07 | |
| CVE-2026-56831 json | Not Provided | 2026-09-15 | 2026-09-16 | |
| CVE-2026-41940 json | cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthentica... | Not Provided | 2026-04-29 | 2026-09-30 |
| CVE-2026-32992 json | SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the requ... | Not Provided | 2026-05-13 | 2026-08-12 |
| CVE-2026-29205 json | Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd att... | Not Provided | 2026-05-13 | 2026-08-12 |
| CVE-2025-66429 json | An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for... | Not Provided | 2025-12-11 | 2026-10-14 |
| CVE-2023-29489 json | An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, a... | 6.1 - MEDIUM | 2023-04-27 | 2023-05-05 |
| CVE-2021-38590 json | In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). | 5.5 - MEDIUM | 2021-08-11 | 2022-05-03 |
| CVE-2021-38589 json | In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588). | 8.1 - HIGH | 2021-08-11 | 2021-08-20 |
| CVE-2021-38588 json | In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587). | 8.1 - HIGH | 2021-08-11 | 2021-08-20 |
| CVE-2021-38587 json | In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586). | 7.5 - HIGH | 2021-08-11 | 2022-07-12 |
| CVE-2021-38586 json | In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589). | 4.4 - MEDIUM | 2021-08-11 | 2021-08-20 |
Known software with vulnerabilities from Cpanel
| Type | Vendor | Product | Version |
|---|---|---|---|
| Application | Cpanel | Cpanel | 11.34.0 |
| Application | Cpanel | Webhost Manager | 11.34.0 |
| Application | Cpanel | Whm | 11.34.0 |