Login Request a demo
1P
Vendor
1Panel-dev
4 products with CVEs on record
67
CVEs
0
On KEV
7
New 30D
Products
CO
CordysCRM
1Panel-dev
9.3
18 CVEs0 on KEV7 new
MA
MaxKB
1Panel-dev
10.0
43 CVEs0 on KEV0 new
1P
1Panel
1Panel-dev
9.8
4 CVEs0 on KEV0 new
KU
KubePi
1Panel-dev
10.0
2 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-108705
CO
CordysCRM
1Panel-dev
4.3
0%
Oct 11CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import
CVE-2026-108704
CO
CordysCRM
1Panel-dev
4.3
0%
Oct 11CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints
CVE-2026-108703
CO
CordysCRM
1Panel-dev
5.4
0%
Oct 11CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push
CVE-2026-108702
CO
CordysCRM
1Panel-dev
4.3
0%
Oct 11CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test
CVE-2026-108701
CO
CordysCRM
1Panel-dev
4.3
0%
Oct 111Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort
CVE-2026-108700
CO
CordysCRM
1Panel-dev
6.5
0%
Oct 111Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title
CVE-2026-108692
CO
CordysCRM
1Panel-dev
6.5
0%
Oct 111Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints
CVE-2026-79919
MA
MaxKB
1Panel-dev
6.3
0%
Sep 21MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)
CVE-2026-79918
MA
MaxKB
1Panel-dev
6.3
0%
Sep 21MaxKB: Sandbox escape via unhooked fexecve
CVE-2026-77517
MA
MaxKB
1Panel-dev
5.4
0%
Sep 21MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base
CVE-2026-77521
MA
MaxKB
1Panel-dev
10.0
1%
Sep 21MaxKB: Prompt-injectable agent can lead to command execution
CVE-2026-77522
MA
MaxKB
1Panel-dev
4.3
0%
Sep 21MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)
CVE-2026-79917
MA
MaxKB
1Panel-dev
6.5
0%
Sep 21MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation
CVE-2026-77516
MA
MaxKB
1Panel-dev
5.4
0%
Sep 21MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path
CVE-2026-77523
MA
MaxKB
1Panel-dev
7.4
0%
Sep 21MaxKB: Cross-workspace model parameter form write
CVE-2026-77525
MA
MaxKB
1Panel-dev
4.2
0%
Sep 21MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id
CVE-2026-77518
MA
MaxKB
1Panel-dev
5.0
0%
Sep 21MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows
CVE-2026-79916
MA
MaxKB
1Panel-dev
9.1
0%
Sep 21MaxKB AWS Bedrock model credential injection leads to remote code execution
CVE-2026-77520
MA
MaxKB
1Panel-dev
5.4
0%
Sep 21MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application
CVE-2026-77519
MA
MaxKB
1Panel-dev
5.4
0%
Sep 21MaxKB: Expired application API keys remain usable on `/chat/api/mcp`
CVE-2026-76899
CO
CordysCRM
1Panel-dev
5.7
0%
Sep 18CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`
CVE-2026-76902
CO
CordysCRM
1Panel-dev
5.0
0%
Sep 18CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`
CVE-2026-76900
CO
CordysCRM
1Panel-dev
6.8
0%
Sep 18CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime
CVE-2026-76901
CO
CordysCRM
1Panel-dev
5.8
0%
Sep 18CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts
CVE-2026-63647
CO
CordysCRM
1Panel-dev
9.3
0%
Sep 18CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`
CVE-2026-63646
CO
CordysCRM
1Panel-dev
6.9
1%
Sep 18CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users
CVE-2026-52745
CO
CordysCRM
1Panel-dev
5.3
0%
Sep 18CordysCRM: Customer Public Pool Sorting Field SQL Injection
CVE-2026-65956
KU
KubePi
1Panel-dev
10.0
1%
Aug 26KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF
CVE-2026-69129
KU
KubePi
1Panel-dev
5.8
0%
Aug 26KubePi: Insufficient per-cluster authorization checks in cluster management APIs
CVE-2026-64870
MA
MaxKB
1Panel-dev
5.3
0%
Jul 30MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation
CVE-2026-16223
CO
CordysCRM
1Panel-dev
6.3
0%
Jul 191Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery
CVE-2026-16222
CO
CordysCRM
1Panel-dev
6.3
0%
Jul 191Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery
CVE-2026-54149
MA
MaxKB
1Panel-dev
8.8
0%
Jul 10MaxKB MCP tool import validation bypass allows post-authentication remote code execution
CVE-2026-56779
MA
MaxKB
1Panel-dev
6.4
0%
Jun 25MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters
CVE-2026-10567
CO
CordysCRM
1Panel-dev
3.5
0%
Jun 21Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting
CVE-2026-10514
CO
CordysCRM
1Panel-dev
2.4
0%
Jun 11Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting
CVE-2026-42336
MA
MaxKB
1Panel-dev
5.1
0%
May 26MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch
CVE-2026-42337
MA
MaxKB
1Panel-dev
5.3
0%
May 26MaxKB: Broken Access Control in MaxKB OSS URL Fetch API
CVE-2026-44847
MA
MaxKB
1Panel-dev
7.5
0%
May 26MaxKB: Webhook Trigger Authentication Bypass
CVE-2026-45412
MA
MaxKB
1Panel-dev
6.3
0%
May 26MaxKB: Unauthenticated SSRF via Workflow Template Import
CVE-2026-45413
MA
MaxKB
1Panel-dev
6.9
0%
May 26MaxKB: Unsalted MD5 Password Hashing
CVE-2026-42335
MA
MaxKB
1Panel-dev
6.3
0%
May 26MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy
CVE-2026-39426
MA
MaxKB
1Panel-dev
5.4
0%
Apr 14MaxKB: Stored XSS via Unsanitized iframe_render Parsing
CVE-2026-39425
MA
MaxKB
1Panel-dev
5.4
0%
Apr 14MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering
CVE-2026-39419
MA
MaxKB
1Panel-dev
3.1
0%
Apr 14MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing
CVE-2026-39424
MA
MaxKB
1Panel-dev
4.7
0%
Apr 14MaxKB has CSV Injection in its Application Chat Export Functionality
CVE-2026-39423
MA
MaxKB
1Panel-dev
5.4
0%
Apr 14Stored XSS via Eval Injection in EchartsRander Component
CVE-2026-39422
MA
MaxKB
1Panel-dev
5.4
0%
Apr 14MaxKB has Stored XSS via ChatHeadersMiddleware
CVE-2026-39421
MA
MaxKB
1Panel-dev
7.4
0%
Apr 14MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect
CVE-2026-39420
MA
MaxKB
1Panel-dev
7.4
0%
Apr 14MaxKB: Sandbox escape via LD_PRELOAD bypass
CVE-2026-39418
MA
MaxKB
1Panel-dev
7.4
0%
Apr 14MaxKB: SSRF via sandbox network hook bypass
CVE-2026-39417
MA
MaxKB
1Panel-dev
5.5
0%
Apr 14MaxKB: RCE via MCP stdio command injection in workflow engine
CVE-2026-23525
1P
1Panel
1Panel-dev
8.4
0%
Jan 181panel App Store vulnerable to Cross-site Scripting
CVE-2025-66446
MA
MaxKB
1Panel-dev
7.5
0%
Dec 11MaxKB has a Python sandbox LD_PRELOAD bypass
CVE-2025-66419
MA
MaxKB
1Panel-dev
10.0
0%
Dec 11MaxKB vulnerable to privilege escalation through sandbox bypass
CVE-2025-66508
1P
1Panel
1Panel-dev
6.5
0%
Dec 91Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers
CVE-2025-66507
1P
1Panel
1Panel-dev
7.5
0%
Dec 91Panel – CAPTCHA Bypass via Client-Controlled Flag
CVE-2025-64703
MA
MaxKB
1Panel-dev
6.5
0%
Nov 13MaxKB has Information Leak in sandbox
CVE-2025-64511
MA
MaxKB
1Panel-dev
8.8
0%
Nov 13MaxKB has SSRF in sandbox
CVE-2025-10433
MA
MaxKB
1Panel-dev
6.3
0%
Sep 151Panel-dev MaxKB debug deserialization