CVE-2026-32992

HighCVSS 8.2/10Last modified Aug 12, 2026

Description

SSL verification is disabled in the DNS Cluster system. This could allow for a malicious server to man-in-the-middle the request and capture credentials.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
WebPros	cPanel	>= 11.136.0.0, < 11.136.0.10; >= 11.134.0.0, < 11.134.0.26; >= 11.132.0.0, < 11.132.0.32; >= 11.130.0.0, < 11.130.0.23; >= 11.126.0.0, < 11.126.0.59
WebPros	WP Squared	>= 11.126.1.0, < 11.136.1.12

References

https://support.cpanel.net/hc/en-us/articles/40437241987607-Security-CVE-2026-32992-cPanel-WHM-WP2-Security-Update-May-13-2026Vendor Advisory

Timeline

Published: May 13, 2026
Last modified: Aug 12, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-329938.3Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject ar CVE-2026-329945.3The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows CVE-2026-329957.5The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 CVE-2026-329967.3This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.CVE-2026-329978.6A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Rep CVE-2026-329989.4This vulnerability in Veeam Service Provider Console allows for remote code execution.CVE-2026-329999.0Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute CVE-2026-33009.8The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and includin CVE-2026-330009.1A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS CVE-2026-330018.8Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives,CVE-2026-330027.5Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made t CVE-2026-330034.3Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they