Threats affecting pkg:rpm/cpanel/cpanel

4 threats

Severity	CVSS	Signals	Threat	Source	Published
High	8.8		CVE-2026-105476WebPros cPanel · Link Following High8.82026-11-02CVE Database V5CVE-2026-105476 CVE-2026-105476 is a high-severity vulnerability in WebPros cPanel involving improper link resolution before file access. This flaw allows remote authenticated users to write arbitrary files owned by root, leading to privilege escalation. The issue affects multiple versions of cPanel prior to fixed releases. A fix is available in versions 11.138.0.19, 11.136.0.51, 11.134.0.67, and 11.110.0.154. Vulnerability CWE-59	CVE Database V5	2026-11-02
High	8.7		CVE-2026-105475WebPros cPanel · Improper Neutralization of Null Byte or NUL Character High8.72026-11-02CVE Database V5CVE-2026-105475 Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data. Vulnerability CWE-158	CVE Database V5	2026-11-02
Critical	9.4	EPSS 0.6%	CVE-2026-87899WebPros cPanel · Execution with Unnecessary Privileges Critical9.4EPSS 0.6%2026-09-23CVE Database V5CVE-2026-87899 Execution with unnecessary privileges in cPanel allows remote authenticated users to execute arbitrary code with root privileges. EPSS 0.6%Vulnerability CWE-250	CVE Database V5	2026-09-23
Critical	9.4	EPSS 0.6%	CVE-2026-58048WebPros cPanel · SQL Injection Critical9.4EPSS 0.6%2026-07-31CVE Database V5CVE-2026-58048 Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context. EPSS 0.6%Vulnerability CWE-89 #ghsa-xgvx-cwxw-9vpj	CVE Database V5	2026-07-31

Page 1 of 1