# cPanel vulnerabilities Source: https://junglewise.ai/threats/vendors/cpanel Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/cpanel.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 24 vulnerabilities in cPanel: 0 in the last 7 days and 14 in the last 90 days, 6 of them critical and 2 exploited in the wild. The most recent, CVE-2026-105476, was published on 2 November 2026. 8 vulnerabilities in the last four weeks, up 33% on the four before (6). 0 critical against 3. 5 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 8 - Last 90 days: 14 - All time: 24 (6 critical, 2 exploited in the wild) ## About cPanel cPanel is a software company that develops a web hosting control panel for automating server and website management. ## Latest cPanel vulnerabilities - [CVE-2026-105476: cPanel symlink resolution race condition allows arbitrary root file write](https://junglewise.ai/threats/cve-2026-105476-improper-link-resolution-before-file-access-in-cpanel-allows) (info, published 2 Nov 2026) - [CVE-2026-105475: cPanel NUL byte injection in calendar and contact access](https://junglewise.ai/threats/cve-2026-105475-improper-neutralization-of-a-nul-byte-in-cpanel-allows-remote) (info, published 2 Nov 2026) - [CVE-2026-110687: Cpanel::JSON::XS canonical encoding misorders byte-string keys](https://junglewise.ai/threats/cve-2026-110687-cpanel-json-xs-versions-from-4-43-before-4-80-for-perl-misorder) (info, published 19 Oct 2026) - [CVE-2026-110682: Cpanel::JSON::XS incremental parser number ambiguity in incr_parse](https://junglewise.ai/threats/cve-2026-110682-cpanel-json-xs-versions-from-4-42-before-4-80-for-perl-let-input) (info, published 19 Oct 2026) - [CVE-2026-110677: Cpanel::JSON::XS memory leak in dupkeys_as_arrayref](https://junglewise.ai/threats/cve-2026-110677-cpanel-json-xs-versions-from-4-28-before-4-80-for-perl-leak-the) (info, published 19 Oct 2026) - [CVE-2026-110674: Cpanel::JSON::XS type confusion in duplicate key handling](https://junglewise.ai/threats/cve-2026-110674-cpanel-json-xs-versions-from-4-33-before-4-80-for-perl-miss) (info, published 19 Oct 2026) - [CVE-2026-110673: Cpanel::JSON::XS stack exhaustion in decode_tag with allow_tags](https://junglewise.ai/threats/cve-2026-110673-cpanel-json-xs-versions-before-4-80-for-perl-allow-stack) (info, published 19 Oct 2026) - [CVE-2026-110672: Cpanel::JSON::XS memory leak in decode_hv with rejected keys](https://junglewise.ai/threats/cve-2026-110672-cpanel-json-xs-versions-before-4-80-for-perl-leak-the-decoded) (info, published 19 Oct 2026) - [CVE-2026-93698: cPanel Multilang adminbin command injection](https://junglewise.ai/threats/cve-2026-93698-insufficient-validation-allows-arbitrary-commands-to-be-executed) (critical, CVSS 9.9, published 2 Oct 2026) - [CVE-2026-93697: cPanel WHM stored XSS in Mass Modify Accounts](https://junglewise.ai/threats/cve-2026-93697-there-is-a-stored-xss-vulnerability-allowing-arbitrary-code) (critical, CVSS 9, published 2 Oct 2026) - [CVE-2026-93029: cPanel WHM stored XSS in Manage SSL Hosts](https://junglewise.ai/threats/cve-2026-93029-there-is-a-stored-xss-vulnerability-allowing-arbitrary-code) (critical, CVSS 9, published 2 Oct 2026) - [CVE-2026-87900: WP Toolkit for cPanel argument injection in file handling](https://junglewise.ai/threats/cve-2026-87900-argument-injection-in-wp-toolkit-for-cpanel-6-11-2-10794-and) (info, published 23 Sep 2026) - [CVE-2026-87899: cPanel privilege escalation allows arbitrary code execution](https://junglewise.ai/threats/cve-2026-87899-execution-with-unnecessary-privileges-in-cpanel-allows-remote) (info, published 23 Sep 2026) - [CVE-2026-68490: cPanel permission assignment information disclosure in CalDAV/CardDAV](https://junglewise.ai/threats/cve-2026-68490-incorrect-permission-assignment-allows-local-users-to-obtain) (info, published 23 Sep 2026) - [CVE-2026-47365: cPanel WordPress Toolkit argument injection in CLI commands](https://junglewise.ai/threats/cve-2026-47365-cpanel-wordpress-toolkit-argument-injection-in-cli-commands) (critical, CVSS 9.9, published 12 Jun 2026) - [CVE-2026-9516: Cpanel Cpanel::JSON::XS denial of service via UTF-8 BOM input](https://junglewise.ai/threats/cve-2026-9516-cpanel-cpanel-json-xs-denial-of-service-via-utf-8-bom-input) (info, CVSS 7.5, published 3 Jun 2026) - [CVE-2026-9334: Cpanel::JSON::XS type confusion via duplicate object keys](https://junglewise.ai/threats/cve-2026-9334-cpanel-json-xs-type-confusion-via-duplicate-object-keys) (info, CVSS 0, published 3 Jun 2026) - [CVE-2026-29206: cPanel sqloptimizer SQL injection in utility script](https://junglewise.ai/threats/cve-2026-29206-cpanel-sqloptimizer-sql-injection-in-utility-script) (high, CVSS 8.1, published 13 May 2026) - [CVE-2026-32992: SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle…](https://junglewise.ai/threats/cve-2026-32992-cpanel-dns-cluster-improper-certificate-validation) (high, CVSS 8.2, published 13 May 2026) - [CVE-2026-29205: Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the…](https://junglewise.ai/threats/cve-2026-29205-cpanel-whm-arbitrary-file-read-in-cpdavd-attachment-download) (high, CVSS 8.6, published 13 May 2026) - [CVE-2026-29203: cPanel Nova plugin symlink following in Cpanel::Nova::Connector](https://junglewise.ai/threats/cve-2026-29203-cpanel-nova-plugin-symlink-following-in-cpanel-nova-connector) (high, CVSS 8.8, published 8 May 2026) - [CVE-2025-66429: An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API…](https://junglewise.ai/threats/cve-2025-66429-an-issue-was-discovered-in-cpanel-110-through-132-a-directory) (high, CVSS 8.8, published 11 Dec 2025) - [CVE-2025-48703: Control Web Panel OS command injection in filemanager](https://junglewise.ai/threats/cve-2025-48703-control-web-panel-os-command-injection-in-filemanager) (critical, exploited in the wild, CVSS 9, published 4 Nov 2025) - [CVE-2022-44877: CWP Control Web Panel OS Command Injection Vulnerability](https://junglewise.ai/threats/cve-2022-44877-cwp-control-web-panel-os-command-injection-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 17 Jan 2023) ## Most severe cPanel vulnerabilities - [CVE-2022-44877: CWP Control Web Panel OS Command Injection Vulnerability](https://junglewise.ai/threats/cve-2022-44877-cwp-control-web-panel-os-command-injection-vulnerability) (critical, exploited in the wild, CVSS 9.8, published 17 Jan 2023) - [CVE-2025-48703: Control Web Panel OS command injection in filemanager](https://junglewise.ai/threats/cve-2025-48703-control-web-panel-os-command-injection-in-filemanager) (critical, exploited in the wild, CVSS 9, published 4 Nov 2025) - [CVE-2026-93698: cPanel Multilang adminbin command injection](https://junglewise.ai/threats/cve-2026-93698-insufficient-validation-allows-arbitrary-commands-to-be-executed) (critical, CVSS 9.9, published 2 Oct 2026) - [CVE-2026-47365: cPanel WordPress Toolkit argument injection in CLI commands](https://junglewise.ai/threats/cve-2026-47365-cpanel-wordpress-toolkit-argument-injection-in-cli-commands) (critical, CVSS 9.9, published 12 Jun 2026) - [CVE-2026-93697: cPanel WHM stored XSS in Mass Modify Accounts](https://junglewise.ai/threats/cve-2026-93697-there-is-a-stored-xss-vulnerability-allowing-arbitrary-code) (critical, CVSS 9, published 2 Oct 2026) - [CVE-2026-93029: cPanel WHM stored XSS in Manage SSL Hosts](https://junglewise.ai/threats/cve-2026-93029-there-is-a-stored-xss-vulnerability-allowing-arbitrary-code) (critical, CVSS 9, published 2 Oct 2026) - [CVE-2025-66429: An issue was discovered in cPanel 110 through 132. A directory traversal vulnerability within the Team Manager API…](https://junglewise.ai/threats/cve-2025-66429-an-issue-was-discovered-in-cpanel-110-through-132-a-directory) (high, CVSS 8.8, published 11 Dec 2025) - [CVE-2026-29203: cPanel Nova plugin symlink following in Cpanel::Nova::Connector](https://junglewise.ai/threats/cve-2026-29203-cpanel-nova-plugin-symlink-following-in-cpanel-nova-connector) (high, CVSS 8.8, published 8 May 2026) - [CVE-2026-29205: Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the…](https://junglewise.ai/threats/cve-2026-29205-cpanel-whm-arbitrary-file-read-in-cpdavd-attachment-download) (high, CVSS 8.6, published 13 May 2026) - [CVE-2026-32992: SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle…](https://junglewise.ai/threats/cve-2026-32992-cpanel-dns-cluster-improper-certificate-validation) (high, CVSS 8.2, published 13 May 2026) ## Vulnerabilities per week 8 vulnerabilities in the last four weeks, up 33% on the four before (6). 0 critical against 3. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 3 | 0 | 0 | | 28 Sep 2026 | 3 | 3 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 6 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 2 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## cPanel technologies - [cPanel JSON::XS](https://junglewise.ai/threats/technologies/json-xs): 8 vulnerabilities - [cPanel](https://junglewise.ai/threats/technologies/cpanel-cpanel): 5 vulnerabilities - [cPanel Whm](https://junglewise.ai/threats/technologies/cpanel-whm-1): 4 vulnerabilities - [cPanel Control Web Panel](https://junglewise.ai/threats/technologies/control-web-panel): 3 vulnerabilities - [cPanel WP Squared](https://junglewise.ai/threats/technologies/wp-squared): 3 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "cPanel vulnerabilities", https://junglewise.ai/threats/vendors/cpanel, 10 November 2026.