{"affected":[{"defaultStatus":"unaffected","product":"cPanel","source":"CNA: hackerone","vendor":"WebPros","versions":[{"lessThan":"11.138.0.19","status":"affected","version":"0","versionType":"semver"},{"lessThan":"11.136.0.51","status":"affected","version":"0","versionType":"semver"},{"lessThan":"11.134.0.67","status":"affected","version":"0","versionType":"semver"},{"lessThan":"11.110.0.154","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-105475","cwes":["CWE-158"],"description":"Improper neutralization of a NUL byte in cPanel allows remote attackers to read any mail account's calendar and contact data.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.7,"severity":"high","source":"CNA: hackerone","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","version":"4.0"}],"modifiedAt":1793654725032,"publishedAt":1793653516277,"references":[{"source":"CNA: hackerone","tags":[],"url":"https://support.cpanel.net/hc/en-us/articles/44356591132439-Security-CVE-2026-105475-Unauthenticated-Access-to-Calendar-and-Contact-Data-in-cPanel-WHM-October-20th-2026"}],"remediation":[],"revision":"5c15b988b2f66c4211632e38f57917af90b6d12f097d6c643035816b4ee7319e","sources":[{"modifiedAt":1793654725032,"name":"CNA: hackerone","retrievedAt":1793657306827,"url":"https://www.cve.org/CVERecord?id=CVE-2026-105475"}],"ssvc":{"assessedAt":1793654528509,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"CVE-2026-105475","updatedAt":1793657306827}