Skip to content

Exploited: 177

LatestCVE-2026-63471 — fastapi-code-generator: Import-time RCE via route path -> unescaped @app.get('...') decorator

8.8

CVE-2026-105476Fix available

Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.

WebPros cPanel2026-11-02 21:17 UTC1 min readRead in

Summary

Improper link resolution before file access in cPanel allows remote authenticated users to write arbitrary root-owned files and escalate privileges.

Remediation

Inventory every WebPros cPanel deployment, including staging.
Upgrade WebPros cPanel to the fixed version for your release line, listed under Affected versions.
Confirm the running version after the upgrade.

References

Referencehttps://support.cpanel.net/hc/en-us/articles/44356595655703-Security-CVE-2026-105476-Arbitrary-File-Write-as-Root-in-cPanel-WHM-October-20th-2026

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

Version	Fixed in
0 – <11.138.0.19	11.138.0.19
0 – <11.136.0.51	11.136.0.51
0 – <11.134.0.67	11.134.0.67
0 – <11.110.0.154	11.110.0.154

Weakness

CWE-59

Timeline

2026-11-02Publicly disclosed

Sources

NVD · CVE