CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 29/04/2026 |
| CVE-2025-66429 | 高危8.8 | An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API allows for overwrite of an arbitrary file. This can allow for privilege escalation to the root user. | 11/12/2025 |
| CVE-2023-29489 | 中危6.1 | An issue was discovered in cPanel before 11.109.9999.116. XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. The fixed versions are 11.109.9999.116, 11.108.0.13, 11.106.0.18, and 11.102.0.31. | 27/04/2023 |
| CVE-2021-38590 | 中危5.5 | In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). | 11/08/2021 |
| CVE-2021-38589 | 高危8.1 | In cPanel before 96.0.13, scripts/fix-cpanel-perl does not properly restrict the overwriting of files (SEC-588). | 11/08/2021 |
| CVE-2021-38588 | 高危8.1 | In cPanel before 96.0.13, fix_cpanel_perl lacks verification of the integrity of downloads (SEC-587). | 11/08/2021 |
| CVE-2021-38587 | 高危7.5 | In cPanel before 96.0.13, scripts/fix-cpanel-perl mishandles the creation of temporary files (SEC-586). | 11/08/2021 |
| CVE-2021-38586 | 中危4.4 | In cPanel before 98.0.1, /scripts/cpan_config performs unsafe operations on files (SEC-589). | 11/08/2021 |
| CVE-2021-38585 | 高危7.2 | The WHM Locale Upload feature in cPanel before 98.0.1 allows unserialization attacks (SEC-585). | 11/08/2021 |
| CVE-2021-38584 | 高危7.2 | The WHM Locale Upload feature in cPanel before 98.0.1 allows XXE attacks (SEC-585). | 11/08/2021 |
| CVE-2021-31803 | 中危6.1 | cPanel before 94.0.3 allows self-XSS via EasyApache 4 Save Profile (SEC-581). | 26/04/2021 |
| CVE-2021-26267 | 高危7.5 | cPanel before 92.0.9 allows a MySQL user (who has an old-style password hash) to bypass suspension (SEC-579). | 26/01/2021 |
| CVE-2021-26266 | 高危7.5 | cPanel before 92.0.9 allows a Reseller to bypass the suspension lock (SEC-578). | 26/01/2021 |
| CVE-2020-29137 | 中危6.1 | cPanel before 90.0.17 allows self-XSS via the WHM Transfer Tool interface (SEC-577). | 27/11/2020 |
| CVE-2020-29136 | 中危6.5 | In cPanel before 90.0.17, 2FA can be bypassed via a brute-force approach (SEC-575). | 27/11/2020 |
| CVE-2020-29135 | 中危4.1 | cPanel before 90.0.17 has multiple instances of URL parameter injection (SEC-567). | 27/11/2020 |
| CVE-2020-26115 | 中危6.1 | cPanel before 90.0.10 allows self XSS via the Cron Editor interface (SEC-574). | 25/09/2020 |