Login Request a demo
HE
Product
hestiacp
by hestiacp · last CVE Oct 16, 2026
12
CVEs
0
On KEV
10.0
Max CVSS
2
New 30D
Vulnerabilities12In the news0Timeline
Severity mix
Critical 2High 6Medium 4Low 0
Severity
All severities12Critical2High6Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add hestiacp to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-43633
10.0
1%
May 19
HestiaCP 1.9.0-1.9.4 Deserialization RCE via Web Terminal
Affected: 1.9.0 through 1.9.4
CVE-2026-108390
9.9
1%
Oct 14
HestiaCP Low-Privileged User to Root via Config-Field Injection and PATH Hijacking
Affected: >= 1.9.7, < 1.10.5
CVE-2025-30007
8.8
3%
Jul 10
HestiaCP < 1.9.5 Authenticated OS Command Injection via DNS Record Management
Affected: before 1.9.5
CVE-2026-12196
8.3
0%
Jul 4
HestiaCP Admin Takeover
Affected: before 8be23943c7e3231f66d226ca931c76f93be98412
CVE-2023-5839
7.8
0%
Oct 29
Privilege Chaining in hestiacp/hestiacp
Affected: before 1.8.9
CVE-2026-43634
7.5
0%
May 19
HestiaCP 1.2.0-1.9.4 IP Spoofing via CF-Connecting-IP Header
Affected: 1.2.0 through 1.9.4
CVE-2021-30070
7.5
1%
Aug 18
An issue was discovered in HestiaCP before v1.3.5
Affected: before 1.3.5
CVE-2026-111627
7.2
1%
Oct 16
HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation
Affected: before 1.10.5
CVE-2023-5084
6.1
0%
Sep 20
Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp
Affected: before 1.8.8
CVE-2023-3479
6.1
1%
Jun 30
Cross-site Scripting (XSS) - Reflected in hestiacp/hestiacp
Affected: before 1.7.8
CVE-2025-30008
5.4
0%
Jul 10
HestiaCP < 1.9.5 Stored XSS via DNS Record Management Interface
Affected: before 1.9.5
CVE-2023-4517
5.4
0%
Oct 13
Cross-site Scripting (XSS) - Stored in hestiacp/hestiacp
Affected: before 1.8.6
Showing 12