Cyberpanel
Approved changes feed: RSS · Atom
cpe:2.3:a:cyberpanel:cyberpanel:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Cyberpanel (fc157df9-8182-5ff7-963e-00f0d777fc1c) |
|---|---|
| Product | Cyberpanel (e3bab6c4-9493-5c4e-9f81-494c9992e9bf) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from purl2cpe mapping
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/usmannasir/cyberpanel |
purl2cpe | 2026-06-01 10:17:30.146203 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-88895 |
vulnerable | 2026-09-16 04:34:09.180232 |
CyberPanel before 3.0.5 Authentication Bypass via API
HIGH (7.2)
CyberPanel before 3.0.5 fails to enforce two-factor authentication on API endpoints, allowing attackers to bypass TOTP requirements using password-derived tokens. Attackers who obtain an administrator's password can derive API tokens and perform administrative operations or create authenticated sessions without the second factor.
Published: 2026-09-10T13:05:42.380Z
Updated: 2026-09-11T19:22:51.358Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-87820 |
vulnerable | 2026-09-16 04:33:01.604661 |
CyberPanel 2.4.3 through 2.4.5 Information Disclosure via AI Scanner
MEDIUM (5.3)
CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints that disclose administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. Unauthenticated attackers can enumerate panel administrators and recent scanner activity to inventory multi-tenant installations and facilitate follow-on attacks.
Published: 2026-09-09T11:21:06.038Z
Updated: 2026-09-14T13:09:00.371Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-29811 |
vulnerable | 2026-09-16 04:32:47.740704 |
Details available
HIGH (7.7)
CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.
Published: 2026-09-13T00:00:00.000Z
Updated: 2026-09-14T18:15:38.129Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-29810 |
vulnerable | 2026-09-16 04:32:47.533528 |
Details available
MEDIUM (4.3)
CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.
Published: 2026-09-13T00:00:00.000Z
Updated: 2026-09-14T16:29:51.368Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-29812 |
vulnerable | 2026-09-16 04:32:47.463105 |
Details available
MEDIUM (4.3)
CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.
Published: 2026-09-13T00:00:00.000Z
Updated: 2026-09-14T18:18:43.832Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41473 |
vulnerable | 2026-06-08 08:03:15.429592 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-41472 |
vulnerable | 2026-06-08 08:03:15.429047 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-56112 |
vulnerable | 2026-06-08 06:54:17.434345 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-54679 |
vulnerable | 2026-06-08 06:54:16.787051 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-53376 |
vulnerable | 2026-06-08 06:54:14.997694 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-51568 |
vulnerable | 2026-06-08 06:52:12.468415 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-51567 |
vulnerable | 2026-06-08 06:52:12.465989 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-51378 |
vulnerable | 2026-06-08 06:52:11.947836 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-47949 |
vulnerable | 2026-06-08 05:38:07.959263 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2019-13056 |
vulnerable | 2026-06-08 05:12:40.827392 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.