aaPanel has 5 CVEs on record. 5 were published in the last 90 days. The busiest recent month was September 2026 with 5. The median CVSS is 8.4 (high), with 1 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-74 (3) and CWE-77 (3).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.4
- Publish → KEV
- —
- Last 90 days
- 5 prev 0
Worst active — by depth score
CVE-2026-101008Critical· 9.1A vulnerability was found in aaPanel BaoTa up to 11.8.050CVE-2026-101009High· 8.4A vulnerability was determined in aaPanel BaoTa up to 11.8.046CVE-2026-101007High· 8.4A vulnerability has been found in aaPanel BaoTa up to 11.8.046CVE-2026-101011Medium· 4.7A security flaw has been discovered in aaPanel BaoTa up to 11.8.026CVE-2026-101010Medium· 4.7A vulnerability was identified in aaPanel BaoTa up to 11.8.026
aaPanel vulnerabilities
CVEs affecting aaPanel, newest first. Open any entry for full detail, references, and exploit status.
5 CVEsRSS
CVE-2026-101011Medium· 4.7A security flaw has been discovered in aaPanel BaoTa up to 11.8.0
A security flaw has been discovered in aaPanel BaoTa up to 11.8.0. This affects the function get_domain_status of the file /www/server/panel/mod/project/domain/domainMod.py of the component Domain Handler. The manipulation of the argumen…
CVE-2026-101010Medium· 4.7A vulnerability was identified in aaPanel BaoTa up to 11.8.0
A vulnerability was identified in aaPanel BaoTa up to 11.8.0. The impacted element is the function getData of the file /www/server/panel/class/data.py. The manipulation of the argument log_type leads to sql injection. It is possible to i…
CVE-2026-101009High· 8.4A vulnerability was determined in aaPanel BaoTa up to 11.8.0
A vulnerability was determined in aaPanel BaoTa up to 11.8.0. The affected element is the function panelTask.bt_task._unzip of the file /www/server/panel/class/panelTask.py of the component Unzip Handler. Executing a manipulation of the …
CVE-2026-101008Critical· 9.1A vulnerability was found in aaPanel BaoTa up to 11.8.0
A vulnerability was found in aaPanel BaoTa up to 11.8.0. Impacted is the function merge_split_file of the file /www/server/panel/class/files.py of the component File Merge Handler. Performing a manipulation of the argument split_file_pat…
CVE-2026-101007High· 8.4A vulnerability has been found in aaPanel BaoTa up to 11.8.0
A vulnerability has been found in aaPanel BaoTa up to 11.8.0. This issue affects the function InputSql of the file class/database.py of the component Database Backup Handler. Such manipulation of the argument Password leads to os command…