panel vulnerabilities

2 known vulnerabilities in panel from ConvoyPanel. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.8 Critical severity

  panel: Improper Authentication

  CVE-2026-33746Apr 2, 2026ConvoyPanel

  Convoy is a KVM server management panel for hosting businesses. From version 3.9.0-beta to before version 4.5.1, the JWTService::decode() method did not verify the cryptographic signature of JWT tokens. While the method configured a symmetric HMAC-SHA256 signe

• 10.0 Critical severity

  panel: Improper Limitation of a Pathname to a Restricted Directory

  CVE-2025-52562Jun 23, 2025ConvoyPanelEPSS 1.82%

  Convoy is a KVM server management panel for hosting businesses. In versions 3.9.0-rc3 to before 4.4.1, there is a directory traversal vulnerability in the LocaleController component of Performave Convoy. An unauthenticated remote attacker can exploit this vuln