Whm (Cpanel) - vulnerabilities (CVEs)

5 CVEs, 0 in the last 30 days, 487 known versions, newest CVE from 2026-05-13. Vendor: Cpanel.

CVEs of Whm

• CVE-2026-32992 - CVSS 8.2 (high), 2026-05-13: SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.
• CVE-2026-29205 - CVSS 8.6 (high), 2026-05-13: Incorrect privileges management and insufficient path filtering allow to read arbitrary file on the server via the cpdavd attachment download endpoints.
• CVE-2026-41940 - CVSS 9.8 (critical), 2026-04-29: cPanel and WHM versions after 11.40 contain an authentication bypass vulnerability in the login flow that allows unauthenticated remote attackers to gain…
• CVE-2012-6449 - CVSS 5.4 (medium), 2020-02-10: The clientconf.html and detailbw.html pages in x3 in cPanel & WHM 11.34.0 (build 8) have a XSS vulnerability.
• CVE-2017-11441 - CVSS 5.4 (medium), 2017-07-19: The WHM Upload Locale interface in cPanel before 56.0.51, 58.x before 58.0.52, 60.x before 60.0.45, 62.x before 62.0.27, 64.x before 64.0.33, and 66.x before…