Vulnerabilities

TI-2026-23385 CVE-2026-29812 · GHSA-35w8-hjmq-qcx9

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.

LOW 20

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00277 Published 2026-09-13 Fixed in 2.4.4 CWE-778

TI-2026-23384 CVE-2026-29811 · GHSA-2m73-7wxp-874w

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that…

LOW 34

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that serves the same content as a primary domain; normally spelled "alias") via an ORM query filter rather than a Python "if" statement.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00336 Published 2026-09-13 Fixed in 2.4.4 CWE-1025

TI-2026-23383 CVE-2026-29810 · GHSA-vfv6-g6x5-rcp8

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.

LOW 20

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00309 Published 2026-09-13 Fixed in 2.4.4 CWE-390

Vulnerabilities

Filters

CyberPanel before 2.4.4 has no logging for actions that could potentially manipulate the child domains list.

CyberPanel before 2.4.4 attempts to detect an "alais" domain (i.e., a second domain that…

CyberPanel before 2.4.4 omits a "return 0" that is required by the business logic.