CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 09:23 UTC)

What this means for you

This week: 5,437 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,437; Show in the list
Critical, last 7 days: 355; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product cyberpanel:cyberpanel. Show all products

7 CVEs, showing 1 to 7

CVE	Severity	Title	Published
CVE-2026-29812	Medium 4.3	CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list. Assigned by mitre	Sep 13, 2026
CVE-2026-29811	High 7.7	CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a P… Assigned by mitre	Sep 13, 2026
CVE-2026-29810	Medium 4.3	CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic. Assigned by mitre	Sep 13, 2026
CVE-2026-41473	Critical 9.1	CyberPanel versions prior to 2.4.5 contain an authentication bypass vulnerability in the AI Scanner worker API endpoints that allows unauthenticated remote attackers to write arbitrary data to the da…	Apr 24, 2026
CVE-2026-41472	Medium 6.1	CyberPanel versions prior to 2.4.5 contain a stored cross-site scripting vulnerability in the AI Scanner dashboard where the POST /api/ai-scanner/callback endpoint lacks authentication and allows una…	Apr 24, 2026
CVE-2024-51567 Known exploited	Critical 10.0	upgrademysqlstatus in databases/views.py in CyberPanel (aka Cyber Panel) before 5b08cd6 allows remote attackers to bypass authentication and execute arbitrary commands via /dataBases/upgrademysqlstat… Assigned by mitre	Oct 29, 2024
CVE-2024-51378 Known exploited	Critical 10.0	getresetstatus in dns/views.py and ftp/views.py in CyberPanel (aka Cyber Panel) before 1c0c6cb allows remote attackers to bypass authentication and execute arbitrary commands via /dns/getresetstatus… Assigned by mitre	Oct 29, 2024

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.