VestaCP
Security Risk Profile
80
/100
criticalSecurity Risk Score
Comprehensive risk assessment based on 25 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from June 18, 2015 to present
25
Total CVEs
16
Critical+High
0
Exploited
11
Unpatched
Threat Assessment
Avg CVSS
7.9
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
11
Critical/High
Risk Level
80/100
critical
Severity Distribution
Critical
11High
5Medium
9Low
0Exploit Likelihood
>50% chance
020-50%
05-20%
0<5%
0Age Distribution
Common Weaknesses (CWE)
1
XSS
7
2
OS Command Injection
4
3
Command Injection
3
4
Malicious File Upload
1
5
Path Traversal
1
Most Affected Products
1. VestaCP Vesta Control Panel14
2. VestaCP Control Panel10
3. VestaCP VestaCP2
4. Myvestacp Myvesta1
5. hestiacp Control Panel1
Recent Vulnerabilities
See more →CVE-2020-36948
CVSS 9.8critical
VestaCP 0.9.8-26 - 'LoginAs' Insufficient Session Validation
1/27/2026🔧 No Patch
CVE-2018-25117
CVSS 9.3critical
VestaCP Debian Installer Malicious Backdoor Supply Chain Compromise
10/15/2025🔧 No Patch
CVE-2022-3967
CVSS 7.8high
Vesta Control Panel sed main.sh argument injection
11/13/2022🔧 No Patch
CVE-2021-46850
CVSS 7.2high
10/24/2022
CVE-2022-36305
CVSS 6.1medium
7/19/2022🔧 No Patch
CVE-2022-36304
CVSS 6.1medium
7/19/2022🔧 No Patch
CVE-2022-36303
CVSS 6.1medium
7/19/2022🔧 No Patch
CVE-2022-34025
CVSS 6.1medium
7/19/2022🔧 No Patch
CVE-2021-43693
CVSS 9.8critical
11/29/2021🔧 No Patch
CVE-2021-30462
CVSS 9.0critical
4/8/2021🔧 No Patch
Monitor VestaCP in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.