cPanel

Search everything

Mentions · 7d0
Mentions · 30d1
All mentions6
First seenSep 11, 2026
Last mentioned28d ago

Timeline

6 articles · newest first

Multiple Cpanel/WHM Vulnerabilities Allow Arbitrary Command Execution On Server

cPanel patched a root command-execution flaw and two stored XSS bugs in WHM.

Cyber Security NewsOct 2, 13:10 UTC · 28d agoVulnerabilityCVE-2026-93698 CVE-2026-93029 CVE-2026-936974 · 1 read

cPanel Permissions Flaw Allows Local Users to Read Other Accounts’ Calendar Data

cPanel patched CVE-2026-68490, which lets local users on shared servers read other accounts' calendars and contacts.

GBHackersSep 24, 07:08 UTC · Sep 24, 2026VulnerabilityCVE-2026-684901 · 1 read

New Cpanel Vulnerability Allows Attackers to Access Other Users’ Accounts

cPanel patched a root privilege escalation and cross-tenant flaws in calendars, contacts, and WordPress databases.

Cyber Security NewsSep 23, 15:18 UTC · Sep 23, 2026VulnerabilityCVE-2026-68490 CVE-2026-87899 CVE-2026-87900+33 · 2 reads

New cPanel Flaw Lets a Hosting Account Run Code as Root, Take Full Server Control

cPanel patched three flaws, including a root code-execution bug any hosting account can use to seize the server.

The Hacker NewsSep 23, 12:16 UTC · Sep 23, 2026VulnerabilityCVE-2026-87899 CVE-2026-87900 CVE-2026-684904 · 1 read

cPanel ConfigServer Security & Firewall Vulnerability Allows Remote Attacker to Execute Arbitrary Commands

CSF 14.00–16.29 (CVE-2026-65638) lets unauthenticated attackers execute arbitrary commands via the MESSENGER service on cPanel/WHM servers; version 16.30 fixes it.

Cyber Security NewsSep 11, 11:28 UTC · Sep 11, 2026Vulnerability 2 sourcesCVE-2026-656382

cPanel Urges Users to Patch ConfigServer Firewall Remote Code Execution Flaw

cPanel urges administrators to patch CVE-2026-65638, a flaw letting unauthenticated attackers run commands through ConfigServer Firewall's MESSENGER service; update to CSF 16.30.

GBHackersSep 11, 11:20 UTC · Sep 11, 2026Vulnerability 2 sourcesCVE-2026-656381 · 1 read

Related CVEs

by mentions

CVE-2026-656389.2
Unauthenticated shell command injection in ConfigServer Security & Firewall (CSF)
published Sep 10, 2026ConfigServer Security & Firewall (CSF)
CVE-2026-684908.2
CalDAV/CardDAV Permission Flaw in cPanel Lets Local Users Read Other Accounts' Data
published Sep 23, 2026cPanel (cPanel, L.L.C. / WebPros) cPanel & WHM (CalDAV/CardDAV calendar and contacts service)
CVE-2026-878999.4
Authenticated Privilege Escalation to Root RCE in cPanel & WHM
published Sep 23, 2026cPanel, L.L.C. cPanel & WHM
CVE-2026-879009.4
Argument Injection in WP Toolkit for cPanel Allows Cross-Account File Read and RCE
published Sep 23, 2026Plesk / WebPros (WP Toolkit) WP Toolkit for cPanel
CVE-2026-67401<1%9.9
Authenticated SQL Injection in cPanel EmailTrack Leads to Root RCE
published Sep 9, 2026cPanel (WebPros) cPanelPoC ×5
CVE-2026-936989.9
Authenticated OS command injection in Multilang adminbin
published 28d agoMultilang adminbin
CVE-2026-936979.0
Stored XSS in WHM Mass Modify Accounts
published 28d agocPanel WHM (WebHost Manager) Mass Modify Accounts
CVE-2026-930299.0
Stored XSS in cPanel WHM Manage SSL Hosts
published 28d agocPanel WHM (WebHost Manager) Manage SSL Hosts
CVE-2026-65643<1%8.7
Authenticated eval injection in cPanel enables root code execution
published Sep 1, 2026cPanel

Appears with

WHMproduct · 6
cPanelproduct · 6
cPanelvendor · 6
ConfigServer Security & Firewallproduct · 3
WP Squaredproduct · 3
WP Toolkitproduct · 2
WebProsorganization · 1
NVDorganization · 1
LiteSpeedvendor · 1
ConfigServervendor · 1
WebProsvendor · 1
Pleskproduct · 1
LiteSpeed Enterpriseproduct · 1

Entities are extracted by the model from each article. First seen Sep 11, 2026, last mentioned 28d ago. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.