Vendor

    aaPanel

    16 known vulnerabilities in products by aaPanel, 0 of them actively exploited (CISA KEV).

    Key figures

    16

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    4

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in aaPanel
    CriticalCVE-2026-101008

    aaPanel BaoTa File Merge files.py merge_split_file command injection

    		9.1
    CriticalCVE-2026-101007

    aaPanel BaoTa Database Backup database.py InputSql os command injection

    		8.4
    CriticalCVE-2026-101009

    aaPanel BaoTa Unzip panelTask.py panelTask.bt_task._unzip os command injection

    		8.4
    HighCVE-2020-14421

    Aapanel: security vulnerability

    		7.2
    HighCVE-2020-14950

    Aapanel: security vulnerability

    		8.8
    HighCVE-2021-37840

    Aapanel: security vulnerability

    		8.8
    MediumCVE-2022-26252

    Aapanel: Path Traversal

    		6.5
    CriticalCVE-2026-29859

    Aapanel: Unrestricted File Upload

    		9.8
    MediumCVE-2024-42922

    Aapanel: OS Command Injection

    		6.5
    MediumCVE-2026-111367

    BillionMail through 4.9 Forgeable JWTs via Default Signing Key

    		6.5
    HighCVE-2025-6813

    aapanel WP Toolkit: Missing Authorization

    		8.8
    HighCVE-2026-29856

    Aapanel: Denial of Service

    		7.5
    HighCVE-2026-29858

    Aapanel: File Inclusion

    		7.5
    MediumCVE-2026-101010

    aaPanel BaoTa data.py getData sql injection

    		4.7
    MediumCVE-2026-101011

    aaPanel BaoTa Domain domainMod.py get_domain_status sql injection

    		4.7
    MediumCVE-2025-12914

    aaPanel BaoTa Backend database sql injection

    		4.7

    Products

    Products by aaPanel
    Aapanel80
    aaPanel BaoTa60