1panel-dev vulnerabilities

Products

• Maxkb 47
• 1panel 20
• Cordyscrm 18
• Kubepi 8

Newest

• 1panel-dev cordyscrm CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import CVE-2026-108705 5.3 MediumOctober 11, 2026
• 1panel-dev cordyscrm CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints CVE-2026-108704 5.3 MediumOctober 11, 2026
• 1panel-dev cordyscrm CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push CVE-2026-108703 5.3 MediumOctober 11, 2026
• 1panel-dev cordyscrm CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test CVE-2026-108702 5.3 MediumOctober 11, 2026
• 1panel-dev cordyscrm 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort CVE-2026-108701 5.3 MediumOctober 11, 2026
• 1panel-dev cordyscrm 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title CVE-2026-108700 7.1 HighOctober 11, 2026
• 1panel-dev cordyscrm 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints CVE-2026-108692 7.1 HighOctober 11, 2026
• 1panel-dev maxkb MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT) CVE-2026-79919 6.3 MediumSeptember 21, 2026
• 1panel-dev maxkb MaxKB: Sandbox escape via unhooked fexecve CVE-2026-79918 6.3 MediumSeptember 21, 2026
• 1panel-dev maxkb MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base CVE-2026-77517 5.4 MediumSeptember 21, 2026
• 1panel-dev maxkb MaxKB: Prompt-injectable agent can lead to command execution CVE-2026-77521 Public exploit 10.0 CriticalSeptember 21, 2026
• 1panel-dev maxkb MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind) CVE-2026-77522 4.3 MediumSeptember 21, 2026
• 1panel-dev maxkb MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation CVE-2026-79917 6.5 MediumSeptember 21, 2026
• 1panel-dev maxkb MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path CVE-2026-77516 5.4 MediumSeptember 21, 2026
• 1panel-dev maxkb MaxKB: Cross-workspace model parameter form write CVE-2026-77523 7.4 HighSeptember 21, 2026
• 1panel-dev maxkb MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id CVE-2026-77525 4.2 MediumSeptember 21, 2026
• 1panel-dev maxkb MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows CVE-2026-77518 5.0 MediumSeptember 21, 2026
• 1panel-dev maxkb MaxKB AWS Bedrock model credential injection leads to remote code execution CVE-2026-79916 9.1 CriticalSeptember 21, 2026
• 1panel-dev maxkb MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application CVE-2026-77520 5.4 MediumSeptember 21, 2026
• 1panel-dev maxkb MaxKB: Expired application API keys remain usable on `/chat/api/mcp` CVE-2026-77519 5.4 MediumSeptember 21, 2026
• 1panel-dev cordyscrm CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page` CVE-2026-76899 5.7 MediumSeptember 18, 2026
• 1panel-dev cordyscrm CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}` CVE-2026-76902 5.0 MediumSeptember 18, 2026
• 1panel-dev cordyscrm CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime CVE-2026-76900 6.8 MediumSeptember 18, 2026
• 1panel-dev cordyscrm CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts CVE-2026-76901 5.8 MediumSeptember 18, 2026
• 1panel-dev cordyscrm CordysCRM SSE Notification Stream Hijack via `/sse/subscribe` CVE-2026-63647 9.3 CriticalSeptember 18, 2026
• 1panel-dev cordyscrm CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users CVE-2026-63646 6.9 MediumSeptember 18, 2026
• 1panel-dev cordyscrm CordysCRM: Customer Public Pool Sorting Field SQL Injection CVE-2026-52745 5.3 MediumSeptember 18, 2026
• 1panel-dev kubepi KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF CVE-2026-65956 10.0 CriticalAugust 26, 2026
• 1panel-dev kubepi KubePi: Insufficient per-cluster authorization checks in cluster management APIs CVE-2026-69129 5.8 MediumAugust 26, 2026
• 1panel-dev maxkb MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation CVE-2026-64870 5.3 MediumJuly 30, 2026
• 1panel-dev cordyscrm 1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery CVE-2026-16223 5.3 MediumJuly 19, 2026
• 1panel-dev cordyscrm 1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery CVE-2026-16222 5.3 MediumJuly 19, 2026
• 1panel-dev maxkb MaxKB MCP tool import validation bypass allows post-authentication remote code execution CVE-2026-54149 8.8 HighJuly 10, 2026
• 1panel-dev maxkb MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters CVE-2026-56779 5.3 MediumJune 25, 2026
• 1panel-dev cordyscrm 1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting CVE-2026-10567 5.1 MediumJune 2, 2026
• 1panel-dev cordyscrm 1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting CVE-2026-10514 4.8 MediumJune 1, 2026
• 1panel-dev maxkb MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch CVE-2026-42336 5.1 MediumMay 26, 2026
• 1panel-dev maxkb MaxKB: Broken Access Control in MaxKB OSS URL Fetch API CVE-2026-42337 5.3 MediumMay 26, 2026
• 1panel-dev maxkb MaxKB: Webhook Trigger Authentication Bypass CVE-2026-44847 7.5 HighMay 26, 2026
• 1panel-dev maxkb MaxKB: Unauthenticated SSRF via Workflow Template Import CVE-2026-45412 6.3 MediumMay 26, 2026
• 1panel-dev maxkb MaxKB: Unsalted MD5 Password Hashing CVE-2026-45413 6.9 MediumMay 26, 2026
• 1panel-dev maxkb MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy CVE-2026-42335 6.3 MediumMay 26, 2026
• 1panel-dev maxkb MaxKB: Stored XSS via Unsanitized iframe_render Parsing CVE-2026-39426 5.1 MediumApril 14, 2026
• 1panel-dev maxkb MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering CVE-2026-39425 5.1 MediumApril 14, 2026
• 1panel-dev maxkb MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing CVE-2026-39419 3.1 LowApril 14, 2026
• 1panel-dev maxkb MaxKB has CSV Injection in its Application Chat Export Functionality CVE-2026-39424 5.3 MediumApril 14, 2026
• 1panel-dev maxkb Stored XSS via Eval Injection in EchartsRander Component CVE-2026-39423 6.9 MediumApril 14, 2026
• 1panel-dev maxkb MaxKB has Stored XSS via ChatHeadersMiddleware CVE-2026-39422 6.9 MediumApril 14, 2026
• 1panel-dev maxkb MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect CVE-2026-39421 6.3 MediumApril 14, 2026
• 1panel-dev maxkb MaxKB: Sandbox escape via LD_PRELOAD bypass CVE-2026-39420 6.3 MediumApril 14, 2026
• Show olderLoading…