CVE-2026-65643HIGH 8.8Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root.
CVE-2026-32992HIGH 8.2SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture…
CVE-2026-29205HIGH 8.6Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment downloa…
CVE-2026-41940CRITICAL 9.8EXPLOITED (CISA KEV)cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote atta…
CVE-2025-66429HIGH 8.8An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of a…