fit2cloud has 7 CVEs on record between 2025 and 2026. 1 was published in the last 90 days. The busiest recent month was December 2025 with 6. The median CVSS is 6.5 (medium). None have a confirmed exploitation report. The most common weakness class is CWE-352 (4). Most affected products: 1panel (5), MeterSphere (1), halo (1).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 6.5
- Publish → KEV
- —
- Last 90 days
- 1 prev 0
Worst active — by depth score
CVE-2026-109189Medium· 6.3A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts47CVE-2025-66507High· 7.51Panel is an open-source, web-based control panel for Linux server management41CVE-2025-34429High· 7.11Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality39CVE-2025-34410High· 7.11Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings panel (/settings/panel)39CVE-2025-66508Medium· 6.51Panel is an open-source, web-based control panel for Linux server management36
fit2cloud vulnerabilities
CVEs affecting fit2cloud, newest first. Open any entry for full detail, references, and exploit status.
7 CVEsRSS
CVE-2026-109189Medium· 6.3PoCA vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts
A vulnerability was detected in fit2cloud MeterSphere up to 3.6.9-lts. The affected element is the function Swagger3ParserApiDefinition.testUrlTimeout of the file backend/parser/api/dataimport/Swagger3ParserApiDefinition.java of the comp…
CVE-2025-34430Medium· 4.31Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel name management functionality
1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel name management functionality. The affected endpoint does not implement CSRF defenses such as anti-CSRF tokens or Origin/Refere…
CVE-2025-34429High· 7.11Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality
1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality. The port-change endpoint lacks CSRF defenses such as anti-CSRF tokens or Origin/Referer validation. A…
CVE-2025-34410High· 7.11Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings panel (/settings/panel)
1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings panel (/settings/panel). The endpoint does not implement CSRF protections such as…
CVE-2025-66508Medium· 6.51Panel is an open-source, web-based control panel for Linux server management
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP addresses as proxies (TrustedProxies = 0.0.0.0/0), allowing any client to spoof …
CVE-2025-66507High· 7.51Panel is an open-source, web-based control panel for Linux server management
1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA verification by abusing a client-controlled parameter. Because the server previ…
CVE-2025-14117Medium· 4.3A vulnerability has been found in fit2cloud Halo 2.21.10
A vulnerability has been found in fit2cloud Halo 2.21.10. Impacted is an unknown function. The manipulation leads to cross-site request forgery. The attack may be initiated remotely. The exploit has been disclosed to the public and may b…