ConvoyPanel vulnerabilities
We track 2 vulnerabilities in ConvoyPanel products across 2 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on April 2, 2026.
2vulnerabilities
2critical
0high
0exploited
9.9average CVSS score
Latest ConvoyPanel vulnerabilities
- 9.8 Critical severity
panel: Improper Authentication
Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signe
- 10.0 Critical severity
panel: Improper Limitation of a Pathname to a Restricted Directory
Convoy is a KVM server management panel for hosting businesses. In versions 3.9.0-rc3 to before 4.4.1, there is a directory traversal vulnerability in the LocaleController component of Performave Convoy. An unauthenticated remote attacker can exploit this vuln