227 matches found
Ajenti Has Potential Remote Code Execution
Impact An unauthenticated user could gain access to a server to execute arbitrary code on this server. Patches This is fixed in the version 2.2.13. Users should upgrade to this version as soon as possible...
EUVD-2026-8832
Ajenti has potential Remote Code Execution...
ajenti-panel (>=2.2.11, <=2.2.12) potentially affected by CVE-2026-27975 via aj (>=2.2.11, <=2.2.12)
aj PYPI version =2.2.11, =2.2.11, =2.2.12 Source cves: CVE-2026-27975 Source advisory: GHSA-VCW3-R3FX-J444...
GHSA-VCW3-R3FX-J444 Ajenti has potential Remote Code Execution
Impact An unauthenticated user could gain access to a server to execute arbitrary code on this server. Patches This is fixed in the version 2.2.13. Users should upgrade to this version as soon as possible...
ajenti-panel (>=2.2.11, <=2.2.12) potentially affected by CVE-2026-27975 via aj (>=2.2.11, <=2.2.12)
aj PYPI version =2.2.11, =2.2.11, =2.2.12 Source cves: CVE-2026-27975 Source advisory: OSV:GHSA-VCW3-R3FX-J444...
Ajenti has potential Remote Code Execution
Impact An unauthenticated user could gain access to a server to execute arbitrary code on this server. Patches This is fixed in the version 2.2.13. Users should upgrade to this version as soon as possible...
CVE-2026-79920
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...
EUVD-2026-84010
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...
CVE-2026-79920
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...
CVE-2026-79920 Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...
CVE-2026-79920
The Ajenti modular server admin panel (Linux & BSD) is vulnerable to local privilege escalation prior to version 2.2.16 . An authenticated user can call the /api/core/tasks/start endpoint to enqueue tasks like InstallPlugin , UnInstallPlugin , or UpgradeAll from plugins/plugins/tasks.py without t...
CVE-2026-79920 Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...
CVE-2026-79920 Ajenti: Privilege escalation to root via unauthenticated/unauthorized plugin install task
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...
CVE-2026-79920: Missing Authorization
Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, UnInstallPlugin, or UpgradeAll from plugins/plugins/tasks.py without plugin-management authorization. InstallPlugin and UnInstallPlugin...
PT-2026-96164
Name of the Vulnerable Software and Affected Versions Ajenti versions prior to 2.2.16 Description Authenticated users can access the '/api/core/tasks/start' endpoint to enqueue the InstallPlugin, UnInstallPlugin, or UpgradeAll functions from 'plugins/plugins/tasks.py' without requiring...
Malicious code in ajenti-plugin-testing-pyld (PyPI)
Source: kam193 8f75e248c6b93183d9fb3295781e0ffda38ca1afa25cefb866205312f2a78cfd Packages that might be part of testing for pentesting / malicious activity / joy, with suspicious activity that does not present any real harm. --- Category: PROBABLYPENTEST - Packages looking like typical pentest...
ajenti.plugin.core has race conditions in 2FA
ImpactIf the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. PatchesThis is fixed in the version 0.112. Users should upgrade to this version as soon as possible...
PYSEC-2026-2340 ajenti.plugin.core has race conditions in 2FA
Impact If the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. Patches This is fixed in the version 0.112. Users should upgrade to this version as soon as possible...
Ajenti has an authorization bypass during custom package installation
ImpactAn authenticated user using the authusers plugin authentication method could install a custom package even if this user is not superuser. PatchesThis is fixed in the version 2.2.15. Users should upgrade to this version as soon as possible...
Missing Authorization
Overview Affected versions of this package are vulnerable to Missing Authorization via the authusers plugin authentication method, an authenticated user could install a custom package even if this user is not a superuser. Remediation Upgrade ajenti-panel to version 2.2.15 or higher. References -...