Login Request a demo
CP
Product
Cpanel
by Cpanel · last CVE Sep 1, 2026
On CISA KEVExploited in the wildRansomware-linked
420
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities420In the news5Timeline
Severity mix
Critical 17High 104Medium 210Low 53
Severity
All severities420Critical17High104Medium210Low53
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Cpanel to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-65643
8.8
1%
Sep 1
Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root
Affected: before 110.0.141; 112.0.0 before 134.0.53; 136.0.0 before 136.0.37; 138.0.0 before 138.0.2; 138.1.0 before 138.1.7
CVE-2025-66429
8.8
1%
Dec 11
An issue was discovered in cPanel 110 through 132
Affected: 110.0.0 before 126.0.37; 128.0.1 before 130.0.16; 132.0.0 before 132.0.4
CVE-2019-20492
8.8
1%
Mar 17
cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516)
Affected: 77.9999.110 before 78.0.43; 81.9999.242 before 82.0.18; 83.9999.115 before 84.0.10
CVE-2019-20490
8.8
1%
Mar 17
cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499)
Affected: 77.9999.110 before 78.0.43; 81.9999.242 before 82.0.18; 83.9999.115 before 84.0.10
CVE-2019-17375
8.8
1%
Oct 9
cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517)
Affected: 81.9999.242 before 82.0.15
CVE-2016-10812
8.8
1%
Aug 7
In cPanel before 57.9999.54, /scripts/enablefileprotect exposed TTYs (SEC-117)
Affected: 11.50.0.4 before 11.50.6.2; 11.51.9999.98 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 55.9999.61 before 56.0.15; 57.9999.48 before 57.9999.54
CVE-2016-10811
8.8
1%
Aug 7
In cPanel before 57.9999.54, /scripts/unsuspendacct exposed TTYs (SEC-116)
Affected: 11.50.0.4 before 11.50.6.2; 11.51.9999.98 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 55.9999.61 before 56.0.15; 57.9999.48 before 57.9999.54
CVE-2016-10810
8.8
1%
Aug 7
In cPanel before 57.9999.54, /scripts/maildir_converter exposed a TTY to an unprivileged process (SEC-115)
Affected: 11.50.0.4 before 11.50.6.2; 11.51.9999.98 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 55.9999.61 before 56.0.15; 57.9999.48 before 57.9999.54
CVE-2016-10809
8.8
1%
Aug 7
In cPanel before 57.9999.54, /scripts/checkinfopages exposed a TTY to an unprivileged process (SEC-114)
Affected: 11.50.0.4 before 11.50.6.2; 11.51.9999.98 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 55.9999.61 before 56.0.15; 57.9999.48 before 57.9999.54
CVE-2016-10808
8.8
1%
Aug 7
In cPanel before 57.9999.54, /scripts/addpop and /scripts/delpop exposed TTYs (SEC-113)
Affected: 11.50.0.4 before 11.50.6.2; 11.51.9999.98 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 55.9999.61 before 56.0.15; 57.9999.48 before 57.9999.54
CVE-2016-10805
8.8
1%
Aug 7
cPanel before 57.9999.54 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-109)
Affected: 11.50.0.4 before 11.50.6.2; 11.51.9999.98 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 55.9999.61 before 56.0.15; 57.9999.48 before 57.9999.54
CVE-2016-10802
8.8
1%
Aug 7
cPanel before 58.0.4 allows code execution in the context of other user accounts through the PHP CGI handler (SEC-142)
Affected: 11.51.9999.98 before 11.52.6.2; 11.54.0.0 before 11.54.0.26; 55.9999.61 before 56.0.27; 57.9999.48 before 58.0.4
CVE-2016-10801
8.8
1%
Aug 7
cPanel before 58.0.4 has improper session handling for shared users (SEC-139)
Affected: 11.54.0.0 before 11.54.0.26; 55.9999.61 before 56.0.27; 57.9999.48 before 58.0.4
CVE-2016-10793
8.8
1%
Aug 6
cPanel before 59.9999.145 allows arbitrary code execution due to an incorrect #! in Mail::SPF scripts (SEC-152)
Affected: 11.51.9999.98 before 11.52.6.6; 11.54.0.0 before 11.54.0.29; 55.9999.61 before 56.0.34; 57.9999.48 before 58.0.29; 59.9999.58 before 59.9999.145
CVE-2016-10792
8.8
1%
Aug 6
cPanel before 59.9999.145 allows code execution in the context of other accounts via mailman list archives (SEC-141)
Affected: 11.51.9999.98 before 11.52.6.6; 11.54.0.0 before 11.54.0.29; 55.9999.61 before 56.0.34; 57.9999.48 before 58.0.29; 59.9999.58 before 59.9999.145
CVE-2016-10789
8.8
1%
Aug 6
cPanel before 60.0.25 allows code execution via the cpsrvd 403 error response handler (SEC-191)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10788
8.8
2%
Aug 6
cPanel before 60.0.25 allows arbitrary code execution via Maketext in PostgreSQL adminbin (SEC-188)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2017-18475
8.8
1%
Aug 5
In cPanel before 62.0.4, Exim piped filters ran in the context of an incorrect user account when delivering to a system user (SEC-204)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2017-18470
8.8
1%
Aug 5
cPanel before 62.0.4 has a fixed password for the Munin MySQL test account (SEC-196)
Affected: 11.54.0.0 before 11.54.0.36; 55.9999.61 before 56.0.43; 57.9999.48 before 58.0.43; 59.9999.58 before 60.0.35; 61.9999.55 before 62.0.4
CVE-2016-10773
8.8
1%
Aug 5
cPanel before 60.0.25 allows format-string injection in exception-message handling (SEC-171)
Affected: 59.9999.58 before 60.0.25
CVE-2017-18433
8.8
2%
Aug 2
cPanel before 64.0.21 allows code execution by webmail and demo accounts via a store_filter API call (SEC-236)
Affected: 55.9999.61 before 56.0.49; 57.9999.48 before 58.0.49; 59.9999.58 before 60.0.43; 61.9999.55 before 62.0.24; 63.9999.74 before 64.0.21
CVE-2016-10826
8.8
1%
Aug 1
cPanel before 55.9999.141 allows attackers to bypass Two Factor Authentication via DNS clustering requests (SEC-93)
Affected: 11.50.0.4 before 11.50.5.2; 11.52.0.5 before 11.52.4.1; 11.54.0.0 before 11.54.0.20
CVE-2016-10820
8.8
1%
Aug 1
cPanel before 55.9999.141 allows daemons to access their controlling TTYs (SEC-31)
Affected: 11.50.0.4 before 11.50.5.2; 11.52.0.5 before 11.52.4.1; after 11.54.0.0. before 11.54.0.20
CVE-2016-10816
8.8
2%
Aug 1
cPanel before 57.9999.54 allows Webmail accounts to execute arbitrary code through forwarders (SEC-121)
Affected: 11.50.0.4 before 11.50.6.2; 11.52.6.0 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 56.0.1 before 56.0.15
CVE-2016-10814
8.8
1%
Aug 1
cPanel before 57.9999.54 allows demo-mode escape via show_template.stor (SEC-119)
Affected: 11.50.0.4 before 11.50.6.2; 11.51.9999.98 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 55.9999.61 before 56.0.15
CVE-2016-10834
8.8
1%
Aug 1
cPanel before 55.9999.141 allows account-suspension bypass via ftp (SEC-105)
Affected: 11.50.0.4 before 11.50.5.2; 11.51.9999.98 before 11.52.4.1; 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141
CVE-2016-10828
8.8
3%
Aug 1
cPanel before 55.9999.141 allows arbitrary code execution because of an unsafe @INC path (SEC-97)
Affected: 11.50.0.4 before 11.50.5.2; 11.51.9999.98 before 11.52.4.1; 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141
CVE-2016-10823
8.8
2%
Aug 1
cPanel before 55.9999.141 allows arbitrary code execution in the context of the root account because of MakeText interpolation (SEC-89)
Affected: 11.50.0.4 before 11.50.5.2; 11.51.9999.98 before 11.52.4.1; 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141
CVE-2016-10840
8.8
2%
Aug 1
cPanel before 11.54.0.4 allows arbitrary code execution during locale duplication (SEC-72)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2016-10850
8.8
2%
Aug 1
cPanel before 11.54.0.4 allows arbitrary code execution via scripts/synccpaddonswithsqlhost (SEC-83)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.52.2.1 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2019-14405
8.8
1%
Jul 30
cPanel before 78.0.18 allows demo accounts to execute code via securitypolicy.cg (SEC-487)
Affected: before 78.0.18
CVE-2019-14401
8.8
1%
Jul 30
cPanel before 78.0.18 allows code execution via an addforward API1 call (SEC-480)
Affected: before 78.0.18
CVE-2019-14398
8.8
1%
Jul 30
cPanel before 80.0.5 allows demo accounts to execute arbitrary code via ajax_maketext_syntax_util.pl (SEC-498)
Affected: before 80.0.5
CVE-2019-14392
8.8
2%
Jul 30
cPanel before 80.0.22 allows remote code execution by a demo account because of incorrect URI dispatching (SEC-501)
Affected: before 80.0.22
CVE-2006-5014
8.8
4%
Sep 27
Unspecified vulnerability in cPanel before 10.9.0 12 Tree allows remote authenticated users to gain privileges via unspecified vectors in (1) mysqladmin and (2) hooksadmin
Affected: 5.0; 5.3; 6.0; 6.2; 6.4; 6.4.1; +13 more
CVE-2026-29205
8.6
8%
May 13
Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints
Affected: 120.0.0 before 124.0.38; 126.0.0 before 126.0.59; 130.0.0 before 130.0.23; 130.0.23 before 130.0.23; 132.0.0 before 132.0.32; 134.0.0 before 134.0.26; +1 more
CVE-2026-32992
8.2
0%
May 13
SSL verification is disabled in the DNS Cluster system
Affected: 126.0.0 before 126.0.59; 130.0.0 before 130.0.23; 132.0.0 before 132.0.32; 134.0.0 before 134.0.26; 136.0.0 before 136.0.10
CVE-2021-38589
8.1
1%
Aug 11
In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588)
Affected: before 11.96.0.13
CVE-2021-38588
8.1
0%
Aug 11
In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587)
Affected: before 96.0.13
CVE-2020-12785
8.1
1%
May 11
cPanel before 86.0.14 allows attackers to obtain access to the current working directory via the account backup feature (SEC-540)
Affected: 11.78.0.1 before 11.78.0.47; 11.84.0.0 before 11.84.0.22; 11.86.0.1 before 11.86.0.14
CVE-2016-10804
8.1
1%
Aug 7
The SQLite journal feature in cPanel before 57.9999.54 allows arbitrary file-overwrite operations during Horde Restore (SEC-58)
Affected: 11.50.0.4 before 11.50.6.2; 11.51.9999.98 before 11.52.6.1; 11.54.0.0 before 11.54.0.24; 55.9999.61 before 56.0.15; 57.9999.48 before 57.9999.54
CVE-2016-10787
8.1
1%
Aug 6
The Host Access Control feature in cPanel before 60.0.25 mishandles actionless host.deny entries (SEC-187)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10771
8.1
1%
Aug 5
cPanel before 60.0.25 allows file-create and file-chmod operations during ModSecurity Audit logfile processing (SEC-165)
Affected: 11.54.0.0 before 11.54.0.33; 55.9999.61 before 56.0.39; 57.9999.48 before 58.0.37; 59.9999.58 before 60.0.25
CVE-2016-10830
8.1
1%
Aug 1
cPanel before 55.9999.141 allows ACL bypass for AppConfig applications via magic_revision (SEC-100)
Affected: 11.50.0.4 before 11.50.5.2; 11.51.9999.98 before 11.52.4.1; 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141
CVE-2016-10825
8.1
1%
Aug 1
cPanel before 55.9999.141 allows attackers to bypass a Security Policy by faking static documents (SEC-92)
Affected: 11.50.0.4 before 11.50.5.2; 11.51.9999.98 before 11.52.4.1; 11.54.0.0 before 11.54.0.20; 55.9999.61 before 55.9999.141
CVE-2016-10847
8.1
1%
Aug 1
cPanel before 11.54.0.4 allows arbitrary file-read and file-write operations via scripts/fixmailboxpath (SEC-80)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2016-10846
8.1
1%
Aug 1
cPanel before 11.54.0.4 allows arbitrary file-chown and file-chmod operations during Roundcube database conversions (SEC-79)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2016-10845
8.1
1%
Aug 1
cPanel before 11.54.0.4 allows arbitrary file-overwrite operations in scripts/check_system_storable (SEC-78)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2016-10843
8.1
1%
Aug 1
cPanel before 11.54.0.4 allows code execution in the context of shared users via JSON-API (SEC-76)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
CVE-2016-10839
8.1
1%
Aug 1
cPanel before 11.54.0.4 allows SQL injection in bin/horde_update_usernames (SEC-71)
Affected: 11.48.0.5 before 11.48.5.2; 11.50.0.4 before 11.50.4.3; 11.51.9999.98 before 11.52.2.4; 11.54.0.0 before 11.54.0.4
Page 1 of 3 · 104 total
123