WebPros cPanel

• CVE-2026-41940 Critical 9.8 Exploited WebPros cPanel and WHM Authentication Bypass via Login Flow 98.5%
• CVE-2026-105476 High 8.8 Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges. 0.5%
• CVE-2026-105475 High 8.7 Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data. 0.4%
• CVE-2026-93029 Critical 9.0 There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Manage SSL Hosts interface. 0.5%
• CVE-2026-93697 Critical 9.0 There is a stored XSS vulnerability allowing arbitrary code execution in the WHM Mass Modify Accounts interface. 0.5%
• CVE-2026-93698 Critical 9.9 Insufficient validation allows arbitrary commands to be executed via the Multilang adminbin. 0.6%
• CVE-2026-87899 Critical 9.4 Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges. 0.6%
• CVE-2026-68490 High 8.2 Incorrect permission assignment allows local users to obtain sensitive CalDAV/CardDAV information belonging to other accounts. 0.1%
• CVE-2026-67401 Critical 9.9 A vulnerability in cPanel allows a mail-enabled account to achieve remote code execution as root through SQLi in EmailTrack component 0.9%
• CVE-2026-65643 High 8.7 Eval injection in cPanel 11.138.0.0 and earlier allows remote authenticated users to execute arbitrary code as root. 0.9%
• CVE-2026-58048 Critical 9.4 Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context. 0.6%
• CVE-2026-58047 Medium 5.6 HTTP Smuggling in cPanel allows potential leak of credentials. 0.5%
• CVE-2026-29206 High 8.1 Insufficient sanitization of SQL queries in the `sqloptimizer` utility script allows SQL Injections on behalf of the root user if Slow Query logging is enabled. 0.3%
• CVE-2026-32991 High 7.1 Improper authorization checks of team members privileges allow a team member to escalate privileges to the team owner account. 0.2%
• CVE-2026-29205 High 8.6 Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints. 8.4%
• CVE-2026-32992 High 8.2 SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials. 0.3%
• CVE-2026-32993 High 8.3 Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response. 0.3%
• CVE-2026-29201 High 8.6 Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed. 0.4%
• CVE-2026-29202 High 8.8 Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user. 1.9%
• CVE-2026-29203 High 8.8 A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege esc 0.5%