cPanel cPanel/WHM

Name: cPanel cPanel/WHM
Brand: cPanel

productDE

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

unpatched

by severity

20critical41high28medium0low

updated 2026-10-27

vulnerabilities (167)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-49113US	high8.8OT critical	99.7% (100th)	KEV	128.0.9	2025-06-02	4 versions
CVE-2026-41940US	—OT critical	98.5% (100th)	KEV	126.0.54	2026-04-29	7 versions
CVE-2025-48384US	—OT critical	4.38% (91st)	KEV	130.0.2	2025-07-08	< 130.0.2
CVE-2026-109619US	high8.1	100.0% (100th)	Exploit	11.110.0.153	2026-10-21	4 versions
CVE-2026-109618US	critical9.8	100.0% (100th)	Exploit	11.110.0.153	2026-10-21	4 versions
CVE-2024-24549US	—	23.1% (98th)	Exploit	132.0.0	2024-03-13	< 132.0.0
CVE-2024-28752US	—	2.93% (87th)	Exploit	132.0.0	2024-03-15	< 132.0.0
CVE-2025-20260US	—	1.63% (76th)	Exploit	132.0.0	2025-06-18	4 versions
CVE-2025-43919US	high7.5	1.41% (72nd)	Exploit	128.0.5	2025-04-20	< 128.0.5
CVE-2026-81642US	critical9.8	0.96% (61st)	Exploit	136.0.44	2026-09-16	2 versions
CVE-2026-65643US	high8.8	0.88% (59th)	Exploit	11.110.0.14	2026-09-01	5 versions
CVE-2026-67401US	—	0.86% (58th)	Exploit	v11.134.0.55	2026-09-09	5 versions
CVE-2025-43920US	high8.1	0.60% (48th)	Exploit	128.0.5	2025-04-20	< 128.0.5
CVE-2026-58048US	—	0.56% (46th)	Exploit	138.1.6 ( WP2 )	2026-07-31	6 versions
CVE-2025-14177US	high7.5	0.51% (43rd)	Exploit	132.0.16	2025-12-27	4 versions
CVE-2025-43921US	medium5.3OT elevated	0.48% (41st)	Exploit	128.0.5	2025-04-20	< 128.0.5
CVE-2026-24031US	high8.2	0.40% (34th)	Exploit	110.0.138	2026-03-27	< 110.0.138
CVE-2026-54433US	critical10.0	0.31% (24th)	Exploit	136.0.29	2026-07-14	5 versions
CVE-2026-29205US	—	8.37% (95th)	—	11.102.0.42	2026-05-13	13 versions
CVE-2026-29202US	—	1.85% (79th)	—	11.102.0.41	2026-05-08	17 versions
CVE-2024-7348US	high7.5	1.57% (75th)	—	130.0.15	2024-08-08	6 versions
CVE-2024-23807US	critical9.8	1.48% (74th)	—	132.0.0	2024-02-29	< 132.0.0
CVE-2026-33278US	critical9.8	1.42% (73rd)	—	137.9999.96	2026-05-20	4 versions
CVE-2025-1735US	high7.5	1.16% (67th)	—	128.0.17	2025-07-13	5 versions
CVE-2025-6491US	—	1.12% (66th)	—	126.0.27	2025-07-13	5 versions
CVE-2026-33598US	critical9.1	1.07% (65th)	—	137.9999.104	2026-04-22	< 137.9999.104
CVE-2025-48385US	—	1.06% (64th)	—	130.0.2	2025-07-08	< 130.0.2
CVE-2025-49739US	—	0.95% (61st)	—	130.0.2	2025-07-08	< 130.0.2
CVE-2026-6722US	critical9.8	0.89% (59th)	—	137.9999.96	2026-05-10	2 versions
CVE-2024-38999US	—	0.84% (58th)	—	110.0.93	2024-07-01	5 versions
CVE-2026-42944US	high7.5	0.84% (58th)	—	137.9999.96	2026-05-20	4 versions
CVE-2023-39743US	medium5.3	0.83% (57th)	—	132.0.0	2023-08-17	< 132.0.0
CVE-2025-66429US	—	0.83% (57th)	—	126.0.37	2025-12-11	7 versions
CVE-2025-20234US	high7.5	0.82% (57th)	—	118.0.50	2025-06-18	4 versions
CVE-2026-42959US	high7.5	0.81% (57th)	—	137.9999.96	2026-05-20	4 versions
CVE-2026-27858US	—	0.80% (56th)	—	110.0.138	2026-03-27	< 110.0.138
CVE-2026-82717US	critical9.8	0.78% (56th)	—	136.0.44	2026-09-16	2 versions
CVE-2026-7262US	high7.5	0.78% (56th)	—	137.9999.96	2026-05-10	2 versions
CVE-2026-41292US	high7.5	0.75% (55th)	—	134.0.51	2026-05-20	4 versions
CVE-2025-1220US	medium5.3	0.75% (55th)	—	118.0.52	2025-07-13	5 versions
CVE-2024-36052US	—	0.75% (55th)	—	132.0.0	2024-05-21	< 132.0.0
CVE-2026-33602US	high8.2	0.73% (54th)	—	137.9999.104	2026-04-22	< 137.9999.104
CVE-2025-59032US	—	0.73% (54th)	—	110.0.138	2026-03-27	< 110.0.138
CVE-2026-20348US	—	0.72% (54th)	—	137.9999.118	2026-08-07	3 versions
CVE-2024-21260US	—OT elevated	0.71% (53rd)	—	132.0.0	2024-10-15	< 132.0.0
CVE-2024-21216US	critical9.8OT elevated	0.71% (53rd)	—	132.0.0	2024-10-15	< 132.0.0
CVE-2025-14180US	high7.5	0.70% (53rd)	—	110.0.81	2025-12-27	4 versions
CVE-2024-21234US	—OT elevated	0.69% (53rd)	—	132.0.0	2024-10-15	< 132.0.0
CVE-2024-25269US	—	0.69% (52nd)	—	132.0.0	2024-03-05	< 132.0.0
CVE-2026-27857US	high7.5	0.68% (52nd)	—	110.0.138	2026-03-27	< 110.0.138

showing 50 of 167

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-125Out-of-bounds Read14 CVEs
CWE-770Allocation of Resources Without Limits or Throttling14 CVEs
CWE-416Use After Free12 CVEs
CWE-20Improper Input Validation11 CVEs
CWE-476NULL Pointer Dereference9 CVEs
CWE-122Heap-based Buffer Overflow8 CVEs
CWE-400Uncontrolled Resource Consumption7 CVEs
CWE-89Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')7 CVEs

sources (2)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)167 CVEs
NLNCSC-NL (CSAF)1 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan