These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-87820 debrief based on the supplied source corpus. The CVE record was published on 2026-09-09T12:17:17.260Z and has not been modified since then. CyberPanel versions 2.4.3 through 2.4.5 expose unauthenticated AI Scanner debugging endpoints, disclosing administrator usernames, API-key prefixes, scan identifiers, target domains, and account metadata. This vulnerability has a medium severity with a [truncated]
CVE-2026-67614 is a critical vulnerability in CyberPanel before version 3.0.0, featuring a hard-coded JWT secret in the WebTerminal FastAPI SSH service. This allows unauthenticated remote attackers to forge valid authentication tokens and gain an interactive root shell via WebSocket on port 8888. The vulnerability is tracked by CVE Program and detailed by NIST's National Vulnerability Database.
CVE-2026-67613 is a path traversal vulnerability in CyberPanel before version 3.0.0. Authenticated administrators can read arbitrary files by manipulating the reportFile parameter in the cloudAPI ReadReport endpoint. This allows access to files readable by the root-privileged CyberPanel process, including sensitive files like credential files, SSL and SSH private keys, and JWT secret files.
CVE-2026-71966 is an authenticated command injection vulnerability in CyberPanel 2.4.3's remote backup transfer feature. Attackers can inject malicious OS commands via a crafted directory name in a remote server's API response, which bypasses security middleware validation and is passed unsanitized to the OS command execution function. The CVE record was published on 2026-08-10T20:17:32.723Z and has not b [truncated]
CVE-2026-71965 is an authenticated remote code execution vulnerability in CyberPanel 2.4.3's remote backup feature. Attackers can exploit this by supplying a malicious remote server address, leading to root-level SSH access. This vulnerability allows attackers to gain root-level SSH access by writing an attacker-controlled public key directly to /root/.ssh/authorized_keys, granting persistent root access [truncated]
CVE-2026-71964 is an arbitrary file read vulnerability in CyberPanel 2.4.3, fixed in commit eca0c3c. The vulnerability allows authenticated attackers to read sensitive system files by uploading a crafted ZIP archive containing symbolic links. The application fails to validate symlinks before extraction, causing symbolic links targeting arbitrary filesystem paths outside the user's home directory to persis [truncated]
CVE-2026-65917 is an insecure direct object reference (IDOR) vulnerability in CyberPanel's IncBackups application, allowing authenticated users to access or manipulate other tenants' backup resources. The vulnerability exists in the incremental-backup handlers (deleteBackup, fetchRestorePoints, and restorePoint) and is caused by the use of an attacker-controlled globally sequential IncJob integer ID that [truncated]
CVE-2026-41473 is an authentication bypass vulnerability in CyberPanel versions prior to 2.4.4. The vulnerability exists in the AI Scanner worker API endpoints, specifically /api/ai-scanner/status-webhook and /api/ai-scanner/callback. This allows unauthenticated remote attackers to write arbitrary data to the database, potentially leading to denial of service through storage exhaustion, corruption of scan [truncated]
CVE-2026-41472 is a stored cross-site scripting vulnerability in CyberPanel versions prior to 2.4.4. The vulnerability exists in the AI Scanner dashboard and is caused by the POST /api/ai-scanner/callback endpoint lacking authentication, allowing unauthenticated attackers to inject malicious JavaScript by overwriting the findings_json field of ScanHistory records. This vulnerability can lead to remote cod [truncated]
