CP
Product
cPanel
On CISA KEVExploited in the wildRansomware-linked
18
CVEs
1
On KEV
9.9
Max CVSS
3
New 30D
Severity mix
Critical 7High 10Medium 1Low 0
Watch
Add cPanel to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-65643 | 8.8 | Sep 1 | Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root Affected: before 11.110.0.141; 11.112.0.0 before 11.134.0.53; 11.136.0.0 before 11.136.0.37; 11.138.0.0 before 11.138.0.2; 11.138.1.0 before 11.138.1.7 |
| CVE-2026-29202 | 8.8 | May 8 | Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system… Affected: 11.136.0.0 before 11.136.0.9; 11.134.0.0 before 11.134.0.25; 11.132.0.0 before 11.132.0.31; 11.130.0.0 before 11.130.0.22; 11.126.0.0 before 11.126.0.58; 11.124.0.0 before 11.124.0.37; +5 more |
| CVE-2026-29203 | 8.8 | May 8 | A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories Affected: 11.136.0.0 before 11.136.0.9; 11.134.0.0 before 11.134.0.25; 11.132.0.0 before 11.132.0.31; 11.130.0.0 before 11.130.0.22; 11.126.0.0 before 11.126.0.58; 11.124.0.0 before 11.124.0.37; +5 more |
| CVE-2026-29205 | 8.6 | May 13 | Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints Affected: 11.136.0.0 before 11.136.0.10; 11.134.0.0 before 11.134.0.26; 11.132.0.0 before 11.132.0.32; 11.130.0.0 before 11.130.0.23; 11.126.0.0 before 11.126.0.59; 11.120.0.0 before 11.124.0.38 |
| CVE-2026-29201 | 8.6 | May 8 | Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed Affected: 11.136.0.0 before 11.136.0.9; 11.134.0.0 before 11.134.0.25; 11.132.0.0 before 11.132.0.31; 11.130.0.0 before 11.130.0.22; 11.126.0.0 before 11.126.0.58; 11.124.0.0 before 11.124.0.37; +5 more |
| CVE-2026-32993 | 8.3 | May 13 | Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response Affected: 11.132.0.0 before 11.132.0.32; 11.134.0.0 before 11.134.0.26; 11.136.0.0 before 11.136.0.10 |
| CVE-2026-68490 | 8.2 | Sep 23 | Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts Affected: 11.120.0.0 before 11.134.0.57; 11.136.0.0 before 11.136.0.41; 11.138.0.0 before 11.138.0.8 |
| CVE-2026-32992 | 8.2 | May 13 | SSL verification is disabled in the DNS Cluster system Affected: 11.136.0.0 before 11.136.0.10; 11.134.0.0 before 11.134.0.26; 11.132.0.0 before 11.132.0.32; 11.130.0.0 before 11.130.0.23; 11.126.0.0 before 11.126.0.59 |
| CVE-2026-29206 | 8.1 | May 13 | Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled Affected: 11.136.0.0 before 11.136.0.10; 11.134.0.0 before 11.134.0.26; 11.132.0.0 before 11.132.0.32; 11.130.0.0 before 11.130.0.23; 11.126.0.0 before 11.126.0.59; 11.124.0.0 before 11.124.0.38; +5 more |
| CVE-2026-32991 | 7.1 | May 13 | Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account Affected: 11.136.0.0 before 11.136.0.10; 11.134.0.0 before 11.134.0.26; 11.132.0.0 before 11.132.0.32; 11.130.0.0 before 11.130.0.23; 11.126.0.0 before 11.126.0.59; 11.124.0.0 before 11.124.0.38; +2 more |
Showing 10