CVE-2026-32993

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

Improper sanitization of the `status` query parameter of the `/unprotected/nova_error` endpoint allows unauthenticated attacker to inject arbitrary HTTP header to the response.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Weakness enumeration

CWE-93

Affected software

Vendor	Product	Versions
WebPros	cPanel	>= 11.132.0.0, < 11.132.0.32; >= 11.134.0.0, < 11.134.0.26; >= 11.136.0.0, < 11.136.0.10
WebPros	WP Squared	>= 11.132.1.0, < 11.136.1.12

References

https://support.cpanel.net/hc/en-us/articles/40437313190295-Security-CVE-2026-32993-cPanel-WHM-WP2-Security-Update-May-13-2026

Timeline

Published: May 13, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-329945.3The /api/v1/autotranslate.translateMessage endpoint in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.6, <7.13.8, and <7.10.12 allows CVE-2026-329957.5The Rocket.Chat DDP method autoTranslate.translateMessage in versions <8.5.0, <8.4.2, <8.3.4, <8.2.4, <8.1.5, <8.0.5, <7.13.8, and <7.10.12 CVE-2026-329967.3This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation.CVE-2026-329978.6A vulnerability allowing an authenticated user with the Backup Administrator role to write arbitrary files on Linux-based Veeam Backup & Rep CVE-2026-329989.4This vulnerability in Veeam Service Provider Console allows for remote code execution.CVE-2026-329999.0Insufficient character filtering in backup agent signing module on Comet Backup server allows authenticated tenant administrator to execute CVE-2026-33009.8The Everest Forms Pro plugin for WordPress is vulnerable to Remote Code Execution via PHP Code Injection in all versions up to, and includin CVE-2026-330009.1A malicious actor with access to the network and high privileges could exploit an Improper Input Validation vulnerability found in UniFi OS CVE-2026-330018.8Jenkins 2.554 and earlier, LTS 2.541.2 and earlier does not safely handle symbolic links during the extraction of .tar and .tar.gz archives,CVE-2026-330027.5Jenkins 2.442 through 2.554 (both inclusive), LTS 2.426.3 through LTS 2.541.2 (both inclusive) performs origin validation of requests made t CVE-2026-330034.3Jenkins LoadNinja Plugin 2.1 and earlier stores LoadNinja API keys unencrypted in job config.xml files on the Jenkins controller where they CVE-2026-330044.3Jenkins LoadNinja Plugin 2.1 and earlier does not mask LoadNinja API keys displayed on the job configuration form, increasing the potential