Threat database

CVE-2026-29205 is a high-severity vulnerability in WebPros cPanel affecting multiple versions. It involves incorrect privilege management and insufficient path filtering in the cpdavd attachment download endpoints, allowing an attacker to read arbitrary files on the server without authentication. The vulnerability has a CVSS score of 8.6, indicating a significant impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available from the vendor. There are no known exploits in the wild at this time.

CVE-2026-32992 is a high-severity vulnerability in WebPros cPanel affecting multiple versions where SSL verification is disabled in the DNS Cluster system. This improper certificate validation (CWE-295) could allow a malicious server to perform a man-in-the-middle attack and capture credentials. There is no official patch or remediation level currently provided by the vendor. The vulnerability has not been reported as exploited in the wild.

CVE-2026-32993 is a high-severity vulnerability in WebPros cPanel versions 11.132.0.0, 11.134.0.0, and 11.136.0.0.

CVE-2026-29204 is a critical vulnerability in WebPros WHMCS affecting versions 7.4.0, 18.13.0, and 9.0.0. It involves an insecure direct object reference (IDOR) due to insufficient ownership checks in the clientarea.php component. An authenticated user can submit requests using another user's addonId without proper validation, potentially gaining unauthorized access to the victim's account.

Insufficient input validation of the feature file name in `feature::LOADFEATUREFILE` adminbin call can cause arbitrary file read when a relative file path is passed.

Insufficient input validation of the `plugin` parameter of the `create_user` plugin allows arbitrary Perl code execution on behalf of the already authenticated account's system user.

A chmod call in the cPanel Nova plugin's Cpanel::Nova::Connector follows symlinks, allowing setting root permissions on arbitrary system files or directories. That can cause DoS or local privilege escalation when an authenticated cPanel user places a symlink at a user-controlled legacy Nova path under their home directory.

A critical IDOR vulnerability has been discovered in Comet Backup affecting all versions from 20.11.0 to 26.1.1 and 26.2.1. The vulnerability allows a tenant administrator to impersonate any end-user account of other tenants on the same server via a vulnerable API call.

cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability that allows unauthenticated remote attackers to gain unauthorized access to the control panel. This critical vulnerability has a CVSS 4.0 score of 9.3 and is known to be actively exploited in the wild, including use in ransomware campaigns.