Skip to content1panel-dev vulnerabilities
Newest
- 1panel-dev maxkbMaxKB: SSRF via sandbox network hook bypassCVE-2026-394185.0 Medium
- 1panel-dev maxkbMaxKB: RCE via MCP stdio command injection in workflow engineCVE-2026-394174.6 Medium
- 1panel-dev maxkb1Panel-dev MaxKB MdPreview chat.ts cross site scriptingCVE-2025-156325.1 Medium
- 1panel-dev maxkb1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injectionCVE-2026-61085.3 Medium
- 1panel-dev maxkb1Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross site scriptingCVE-2026-61075.1 Medium
- 1panel-dev maxkb1Panel-dev MaxKB Public Chat static_headers_middleware.py StaticHeadersMiddleware cross site scriptingCVE-2026-61065.1 Medium
- 1panel-dev 1panel1panel App Store vulnerable to Cross-site ScriptingCVE-2026-235256.4 Medium
- 1panel-dev maxkbMaxKB has a Python sandbox LD_PRELOAD bypassCVE-2025-664468.8 High
- 1panel-dev maxkbMaxKB vulnerable to privilege escalation through sandbox bypassCVE-2025-664198.8 High
- 1panel-dev 1panel1Panel CSRF Web Port Configuration ChangeCVE-2025-344297.0 High
- 1panel-dev 1panel1Panel CSRF Panel Name ModificationCVE-2025-344305.1 Medium
- 1panel-dev 1panel1Panel CSRF in Change Username Functionality Allows Account LockoutCVE-2025-344107.0 High
- 1panel-dev 1panel1Panel IP Access Control Bypass via Untrusted X-Forwarded-For HeadersCVE-2025-66508Fix available6.5 Medium
- 1panel-dev 1panel1Panel – CAPTCHA Bypass via Client-Controlled FlagCVE-2025-66507Fix available7.5 High
- 1panel-dev maxkbMaxKB has Information Leak in sandboxCVE-2025-647036.3 Medium
- 1panel-dev maxkbMaxKB has SSRF in sandboxCVE-2025-645117.4 High
- 1panel-dev maxkb1Panel-dev MaxKB debug deserializationCVE-2025-104335.3 Medium
- 1panel-dev 1panel1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command ExecutionCVE-2025-54424Public exploitFix available8.1 High
- 1panel-dev maxkbMaxKB has RCE in MCP callCVE-2025-539284.6 Medium
- 1panel-dev maxkbMaxKB sandbox bypassCVE-2025-539274.6 Medium
- 1panel-dev maxkbMaxKB Python Sandbox Bypass in Function LibraryCVE-2025-489505.8 Medium
- 1panel-dev maxkb1Panel-dev MaxKB Knowledge Base Module csv injectionCVE-2025-45465.1 Medium
- 1panel-dev maxkbMaxKB has a reverse shell vulnerability in function libraryCVE-2025-323834.3 Medium
- 1panel-dev maxkbMaxKB RCE vulnerability in function libraryCVE-2024-561376.8 Medium
- 1panel-dev kubepiKubePi's JWT token validation has a defectCVE-2024-361116.3 Medium
- 1panel-dev 1panel1Panel SQL injectionCVE-2024-39911Fix available10.0 Critical
- 1panel-dev 1panela sqlinjection in 1PanelCVE-2024-39907Fix availableEPSS 29.2%9.8 Critical
- 1panel-dev 1panelArbitrary file write vulnerability in 1PanelCVE-2024-34352Fix available6.5 Medium
- 1panel-dev 1panel1Panel's password verification is suspected to have a timing attack vulnerabilityCVE-2024-30257Fix available3.9 Low
- 1panel-dev 1panel1Panel swap baseApi.UpdateDeviceSwap command injectionCVE-2024-2352Fix available6.3 Medium
- 1panel-dev 1panel1Panel open source panel project has an unauthorized vulnerability.CVE-2024-27288Fix available6.3 Medium
- 1panel-dev 1panel1Panel set-cookie is missing the Secure keywordCVE-2024-24768Fix available6.5 Medium
- 1panel-dev 1panel1Panel arbitrary file write vulnerability exists in the backgroundCVE-2023-39966Fix available7.5 High
- 1panel-dev 1panel1Panel Unauthorized access in BackendCVE-2023-39965Fix available6.5 Medium
- 1panel-dev 1panel1Panel O&M management panel has a background arbitrary file reading vulnerabilityCVE-2023-39964Fix available7.5 High
- 1panel-dev kubepiLeak password hash of any userCVE-2023-37916Fix available6.5 Medium
- 1panel-dev kubepiPrivilege Escalation in kubepiCVE-2023-37917Fix available9.1 Critical
- 1panel-dev 1panelCommand injection in firewall ip functionality in 1PanelCVE-2023-37477Fix available7.2 High
- 1panel-dev 1panel1Panel vulnerable to command injection when adding container repositoriesCVE-2023-36457Fix available6.3 Medium
- 1panel-dev 1panel1Panel vulnerable to ommand injection when entering the container terminalCVE-2023-36458Fix available6.3 Medium
- 1panel-dev kubepiKubePi vulnerable to session fixation attackCVE-2023-22479Fix available7.5 High
- 1panel-dev kubepiKubePi is vulnerable to missing authorizationCVE-2023-22478Fix available7.3 High
- 1panel-dev kubepiKubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT tokenCVE-2023-22463Fix availableEPSS 69.7%9.8 Critical