High · 8.7 CVE-2026-105475 EUVD-2026-115630GHSA-rcwx-58mq-xwr6

Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.

Published Nov 2, 2026 · Updated Nov 2, 2026 · Assigned by hackerone

Description

Vendor	Product	Affected	Fixed
WebPros	cPanel	< 11.138.0.19, < 11.136.0.51, < 11.134.0.67, < 11.110.0.154	11.138.0.19