{"id":"CVE-2026-105475","title":"Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.","summary":"Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.","severity":"high","cvss":8.7,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","cvssSource":"cna","cwe":["CWE-158"],"vendor":"WebPros","product":"cPanel","affected":["cPanel < 11.138.0.19","cPanel < 11.136.0.51","cPanel < 11.134.0.67","cPanel < 11.110.0.154"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-11-02T21:22:08.509417Z"},"published":"2026-11-02","updated":"2026-11-02","sourceUpdated":"2026-11-02T21:25:25.032Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105475","references":[{"url":"https://support.cpanel.net/hc/en-us/articles/44356591132439-Security-CVE-2026-105475-Unauthenticated-Access-to-Calendar-and-Contact-Data-in-cPanel-WHM-October-20th-2026"}],"tags":["cve.org"],"epss":0.00401,"epssPercentile":0.3456,"ingestedAt":"2026-11-05T19:30:42.857Z","slug":"CVE-2026-105475","body":"## Overview\n\nImproper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.\n\n## Affected\n\n- `cPanel < 11.138.0.19`\n- `cPanel < 11.136.0.51`\n- `cPanel < 11.134.0.67`\n- `cPanel < 11.110.0.154`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}