cPanel & WHM

Search everything

Mentions · 7d0
Mentions · 30d0
All mentions3
First seenAug 28, 2026
Last mentionedOct 2, 2026

Timeline

3 articles · newest first

Multiple cPanel & WHM Vulnerabilities Enable Root Code Execution and Admin Session Hijacking

cPanel patched a critical root command-execution flaw and two WHM stored XSS bugs across supported versions.

GBHackersOct 2, 11:26 UTC · Oct 2, 2026VulnerabilityCVE-2026-93698 CVE-2026-93029 CVE-2026-936972 · 1 read

WebPros security advisory (AV26-908)

Canada's Cyber Centre relays WebPros advisories for SQL injection (CVE-2026-67401) in cPanel and two ConfigServer Firewall flaws.

Canadian Centre for Cyber SecuritySep 10, 17:38 UTC · Sep 10, 2026AdvisoryCVE-2026-65638 CVE-2026-65639 CVE-2026-674012 · 1 read

Critical cPanel Flaw Could Let One Hosting Customer Take Root Control of a Whole Server

cPanel patched critical flaw CVE-2026-65643 letting authenticated hosting customers with addon or parked domain rights execute code as root and fully compromise servers.

The Hacker NewsAug 28, 09:45 UTC · Aug 28, 2026VulnerabilityCVE-2026-65643 CVE-2026-58048 CVE-2026-58047+31

Related CVEs

by mentions

CVE-2026-544201%8.5
Symlink-Following Privilege Escalation in LiteSpeed cPanel Plugin Exploited in the Wild
published Jun 14, 2026LiteSpeed Technologies LiteSpeed cPanel pluginKEV
CVE-2026-936989.9
Authenticated OS command injection in Multilang adminbin
published Oct 2, 2026Multilang adminbin
CVE-2026-67401<1%9.9
Authenticated SQL Injection in cPanel EmailTrack Leads to Root RCE
published Sep 9, 2026cPanel (WebPros) cPanelPoC ×5
CVE-2026-656399.5
OS Command Injection in ConfigServer Security & Firewall (CSF) Allows Root RCE
published Sep 10, 2026ConfigServer Security & Firewall (CSF) - original distribution
CVE-2026-58048<1%9.4
Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context
published Jul 31, 2026
CVE-2026-656389.2
Unauthenticated shell command injection in ConfigServer Security & Firewall (CSF)
published Sep 10, 2026ConfigServer Security & Firewall (CSF)
CVE-2026-936979.0
Stored XSS in WHM Mass Modify Accounts
published Oct 2, 2026cPanel WHM (WebHost Manager) Mass Modify Accounts
CVE-2026-930299.0
Stored XSS in cPanel WHM Manage SSL Hosts
published Oct 2, 2026cPanel WHM (WebHost Manager) Manage SSL Hosts
CVE-2026-65643<1%8.7
Authenticated eval injection in cPanel enables root code execution
published Sep 1, 2026cPanel
CVE-2026-58047<1%5.6
HTTP Smuggling in cPanel allows potential leak of credentials
published Jul 31, 2026

Appears with

cPanelvendor · 3
WebProsvendor · 2
ConfigServer Security & Firewallvendor · 1
CloudLinuxvendor · 1
LiteSpeedvendor · 1
Pleskvendor · 1
Canadian Centre for Cyber Securityorganization · 1
Phusion Passengervendor · 1
ConfigServer Security & Firewallproduct · 1
CISAorganization · 1
WP Squaredproduct · 1

Entities are extracted by the model from each article. First seen Aug 28, 2026, last mentioned Oct 2, 2026. Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.