cPanel before 82.0.18 allows WebDAV authentication bypass because the connection-sharing logic is incorrect (SEC-534).

cPanel before 82.0.18 allows authentication bypass because webmail usernames are processed inconsistently (SEC-499).

cPanel before 82.0.18 allows authentication bypass because of misparsing of the format of the password file (SEC-516).

cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated (SEC-517).

cPanel before 82.0.18 allows attackers to read an arbitrary database via MySQL dump streaming (SEC-531).

cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled (SEC-520).

cPanel before 82.0.15 allows self XSS in the SSL Key Delete interface (SEC-526).

cPanel before 82.0.15 allows self XSS in the SSL Certificate Upload interface (SEC-521).

cPanel before 82.0.15 allows self stored XSS in the WHM SSL Storage Manager interface (SEC-527).

cPanel before 82.0.15 allows self XSS in LiveAPI example scripts (SEC-524).

cPanel before 82.0.18 allows attackers to leverage virtual mail accounts in order to bypass account suspensions (SEC-508).

cPanel before 82.0.18 allows attackers to conduct arbitrary chown operations as root during log processing (SEC-532).

cPanel before 82.0.18 allows stored XSS via WHM Backup Restoration (SEC-533).

In cPanel before 82.0.18, Cpanel::Rand::Get can produce a predictable series of numbers (SEC-525).