Login Request a demo
CO
Product
CordysCRM
by 1Panel-dev · last CVE Oct 11, 2026
18
CVEs
0
On KEV
9.3
Max CVSS
7
New 30D
Vulnerabilities18In the news0Timeline
Severity mix
Critical 1High 0Medium 15Low 2
Severity
All severities18Critical1High0Medium15Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add CordysCRM to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-63647
9.3
0%
Sep 18
CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`
Affected: < 1.7.2
CVE-2026-63646
6.9
1%
Sep 18
CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users
Affected: < 1.7.2
CVE-2026-76900
6.8
0%
Sep 18
CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime
Affected: = 1.7.3
CVE-2026-108700
6.5
0%
Oct 11
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title
Affected: before 1.9.2
CVE-2026-108692
6.5
0%
Oct 11
1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints
Affected: 1.9.0 before 1.9.2
CVE-2026-16223
6.3
0%
Jul 19
1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery
Affected: 1.4.0; 1.4.1
CVE-2026-16222
6.3
0%
Jul 19
1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery
Affected: 1.4.0; 1.4.1
CVE-2026-76901
5.8
0%
Sep 18
CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts
Affected: < 1.7.4
CVE-2026-76899
5.7
0%
Sep 18
CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`
Affected: < 1.7.4
CVE-2026-108703
5.4
0%
Oct 11
CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push
Affected: through 1.9.3
CVE-2026-52745
5.3
0%
Sep 18
CordysCRM: Customer Public Pool Sorting Field SQL Injection
Affected: < 1.7.0
CVE-2026-76902
5.0
0%
Sep 18
CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`
Affected: < 1.7.4
CVE-2026-108705
4.3
0%
Oct 11
CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import
Affected: through 1.9.3
CVE-2026-108704
4.3
0%
Oct 11
CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints
Affected: through 1.9.3
CVE-2026-108702
4.3
0%
Oct 11
CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test
Affected: through 1.9.3
CVE-2026-108701
4.3
0%
Oct 11
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort
Affected: before 1.9.2
CVE-2026-10567
3.5
0%
Jun 2
1Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting
Affected: 1.4.0; 1.4.1
CVE-2026-10514
2.4
0%
Jun 1
1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting
Affected: 1.6.0; 1.6.1; 1.6.2
Showing 18