Vulnerabilidades de Ajenti
CVEs publicadas que afetam produtos de Ajenti: 4 registro(s), com severidade, exploração e correções.
CVE-2026-40178
Média · 5.9
CWE-287 10/04/2026
ajenti.plugin.core has a race conditions in 2FA
ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible during a short moment after the authentication of an user to bypass its authentication. This vulnerability is fixed in 0.112.
CVE-2026-40177
Alta · 7.5
CWE-287 10/04/2026
Password bypass when 2FA is activated
ajenti.plugin.core defines all necessary core elements to allow Ajenti to run properly. Prior to 0.112, if the 2FA was activated, it was possible to bypass the password authentication This vulnerability is fixed in 0.112.
CVE-2026-35175
Média · 6.5
CWE-862 06/04/2026
Ajenti has an authorization bypass during custom package installation
Ajenti is a Linux and BSD modular server admin panel. Prior to 2.2.15, an authenticated user (using the auth_users plugin authentication method) could install a custom package even if this user is not superuser. This vulnerability is fixed in 2.2.15.
CVE-2026-27975
Crítica · 9.8
CWE-284 26/02/2026
Ajenti has a potential Remote Code Execution
Ajenti is a Linux and BSD modular server admin panel. Prior to version 2.2.13, an unauthenticated user could gain access to a server to execute arbitrary code on this server. This is fixed in the version 2.2.13.