Login Request a demo
AA
Product
aaPanel
by Aapanel · last CVE Oct 20, 2026
11
CVEs
0
On KEV
9.9
Max CVSS
3
New 30D
Vulnerabilities11In the news0Timeline
Severity mix
Critical 2High 5Medium 4Low 0
Severity
All severities11Critical2High5Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add aaPanel to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-113506
9.9
2%
Oct 20
aaPanel File Manager common.py ExecShell os command injection
Affected: 8.0; 8.1; 8.2; 8.3; 8.4; 8.5; +20 more
CVE-2026-29859
9.8
1%
Mar 18
An arbitrary file upload vulnerability in aaPanel v7.57.0 allows attackers to execute arbitrary code via uploading a crafted file
Affected: 7.57.0
CVE-2021-37840
8.8
2%
Aug 2
aaPanel through 6.8.12 allows Cross-Site WebSocket Hijacking (CSWH) involving OS commands within WebSocket messages at a ws:// URL for /webssh (the victim must have configured…
Affected: through 6.8.12
CVE-2020-14950
8.8
3%
Jun 21
aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via shell metacharacters in a modified /system?action=ServiceAdmin request (start, stop, or…
Affected: through 6.6.6
CVE-2026-29858
7.5
0%
Mar 18
A lack of path validation in aaPanel v7.57.0 allows attackers to execute a local file inclusion (LFI), leadingot sensitive information exposure
Affected: 7.57.0
CVE-2026-29856
7.5
0%
Mar 18
An issue in the VirtualHost configuration handling/parser component of aaPanel v7.57.0 allows attackers to cause a Regular Expression Denial of Service (ReDoS) via a crafted input
Affected: 7.57.0
CVE-2020-14421
7.2
6%
Jun 18
aaPanel through 6.6.6 allows remote authenticated users to execute arbitrary commands via the Script Content box on the Add Cron Job screen
Affected: through 6.6.6
CVE-2024-42922
6.5
1%
May 21
AAPanel v7.0.7 was discovered to contain an OS command injection vulnerability
Affected: through 7.0.7
CVE-2022-26252
6.5
2%
Mar 27
aaPanel v6.8.21 was discovered to be vulnerable to directory traversal
Affected: 6.8.21
CVE-2026-113507
5.3
0%
Oct 20
aaPanel common.py GetClientIp access control
Affected: 8.0; 8.1; 8.2; 8.3; 8.4; 8.5; +20 more
CVE-2026-113505
4.3
0%
Oct 20
aaPanel Download Endpoint v2.py send_file path traversal
Affected: 8.0; 8.1; 8.2; 8.3; 8.4; 8.5; +20 more
Showing 11