VulnSea

aaPanel has 6 CVEs on record. Disclosure cadence is accelerating: 6 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 5. The median CVSS is 7.5 (high), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-74 (3) and CWE-77 (3). Most affected products: BaoTa (5), BillionMail (1).

CVEs per month

Last 12 months, by publish date

111201020304050607080910
Exploited share
0% vs 1% corpus
Median CVSS
7.5
Publish → KEV
—
Last 90 days
6 prev 0

Products

  • BaoTa 5
  • BillionMail 1
Follow aaPanel:RSS feedSave a search →Embed badge ↗
6
Total CVEs
1
Critical
0
CISA KEV
0
Exploited

Worst active — by depth score

aaPanel vulnerabilities

CVEs affecting aaPanel, newest first. Open any entry for full detail, references, and exploit status.

6 CVEsRSS

CVE-2026-111367Medium· 6.5PoC
2w ago

BillionMail through 4.9 Forgeable JWTs via Default Signing Key

BillionMail through 4.9 contains a hard-coded cryptographic key vulnerability that allows unauthenticated attackers to forge unsubscribe and subscribe-confirm JWTs by computing the key from shipped configuration constants. Attackers can …

▾ TwilightaaPanel · BillionMailEPSS 0.33%via CVEORG
CVE-2026-101011Medium· 4.7PoC
1mo ago

A security flaw has been discovered in aaPanel BaoTa up to 11.8.0

A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function get_domain_status of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argumen…

▾ TwilightaaPanel · BaoTaEPSS 0.20%via NVD
CVE-2026-101010Medium· 4.7PoC
1mo ago

A vulnerability was identified in aaPanel BaoTa up to 11.8.0

A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument log_type leads to sql injection. It is possible to i…

▾ TwilightaaPanel · BaoTaEPSS 0.25%via NVD
CVE-2026-101009High· 8.4PoC
1mo ago

A vulnerability was determined in aaPanel BaoTa up to 11.8.0

A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bt_task._unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the …

▾ MidnightaaPanel · BaoTaEPSS 1.8%via NVD
CVE-2026-101008Critical· 9.1PoC
1mo ago

A vulnerability was found in aaPanel BaoTa up to 11.8.0

A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument split_file_pat…

▾ AbyssalaaPanel · BaoTaEPSS 2.3%via NVD
CVE-2026-101007High· 8.4PoC
1mo ago

A vulnerability has been found in aaPanel BaoTa up to 11.8.0

A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command…

▾ MidnightaaPanel · BaoTaEPSS 2.1%via NVD
aaPanel vulnerabilities (CVEs) · VulnSea