1panel-dev - vulnerabilities (CVEs)
74 CVEs in 4 products, 0 in the last 30 days, newest from 2026-09-21.
Products
Newest CVEs of 1panel-dev
- CVE-2026-79919 - CVSS 6.3 (medium), 2026-09-21: MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LD_PRELOAD sandbox can invoke…
- CVE-2026-79918 - CVSS 6.3 (medium), 2026-09-21: MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, the ToolExecutor LD_PRELOAD sandbox hooks execve, execvpe, and execveat to…
- CVE-2026-77517 - CVSS 5.4 (medium), 2026-09-21: MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id…
- CVE-2026-77521 - CVSS 10 (critical), 2026-09-21: MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use…
- CVE-2026-77522 - CVSS 4.3 (medium), 2026-09-21: MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes…
- CVE-2026-79917 - CVSS 6.5 (medium), 2026-09-21: MaxKB is an open-source AI assistant for enterprise. In 2.7.0 through 2.10.4-lts, POST /chat/api/{application_id}/chat/{chat_id}/share_chat verifies that a…
- CVE-2026-77516 - CVSS 5.4 (medium), 2026-09-21: MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by…
- CVE-2026-77523 - CVSS 7.4 (high), 2026-09-21: MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the model parameter form route authorizes the path workspace but…
- CVE-2026-77525 - CVSS 4.2 (medium), 2026-09-21: MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path application_id but load…
- CVE-2026-77518 - CVSS 5 (medium), 2026-09-21: MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP tool_id in the…
- CVE-2026-79916 - CVSS 9.1 (critical), 2026-09-21: MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock…
- CVE-2026-77520 - CVSS 5.4 (medium), 2026-09-21: MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's application_id…
- CVE-2026-77519 - CVSS 5.4 (medium), 2026-09-21: MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, the /chat/api/mcp authentication path looks up an ApplicationApiKey using only…
- CVE-2026-76899 - CVSS 5.7 (medium), 2026-09-18: CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST…
- CVE-2026-76902 - CVSS 5 (medium), 2026-09-18: CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures…
- CVE-2026-76900 - CVSS 6.8 (medium), 2026-09-18: CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3,…
- CVE-2026-76901 - CVSS 5.8 (medium), 2026-09-18: CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, GET /pool/lead/get/{id} in…
- CVE-2026-63647 - CVSS 9.3 (critical), 2026-09-18: CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the…
- CVE-2026-63646 - CVSS 6.9 (medium), 2026-09-18: CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, GET…
- CVE-2026-52745 - CVSS 5.3 (medium), 2026-09-18: CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.0, the POST /account-pool/page…
- CVE-2026-65956 - CVSS 10 (critical), 2026-08-26: KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same…
- CVE-2026-69129 - CVSS 5.8 (medium), 2026-08-26: KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 2.0.0, cluster-scoped APIs do not consistently validate per-cluster…
- CVE-2026-64870 - CVSS 5.3 (medium), 2026-07-30: MaxKB is an open-source AI assistant for enterprise. In versions 2.0.0 through 2.10.4-lts, UpdateStoreTool.update_tool passes caller-supplied download_url and…
- CVE-2026-16223 - CVSS 6.3 (medium), 2026-07-19: A vulnerability was determined in 1Panel-dev CordysCRM up to 1.4.1. Impacted is the function getSqlBotSrc of the file…
- CVE-2026-16222 - CVSS 6.3 (medium), 2026-07-19: A vulnerability was found in 1Panel-dev CordysCRM up to 1.4.1. This issue affects some unknown processing of the file…
- CVE-2026-54149 - CVSS 8.8 (high), 2026-07-10: MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.0-lts, MaxKB tool import functionality in apps/tools/serializers/tool.py and MCP…
- CVE-2026-10567 - CVSS 5.1 (medium), 2026-06-02: A security vulnerability has been detected in 1Panel-dev CordysCRM up to 1.4.1. This impacts the function Save of the file…
- CVE-2026-10514 - CVSS 4.8 (medium), 2026-06-02: A vulnerability has been found in 1Panel-dev CordysCRM up to 1.6.2. This affects an unknown function of the file…
- CVE-2026-45413 - CVSS 6.9 (medium), 2026-05-26: MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, user passwords are stored using unsalted MD5 hashes, making them trivially crackable via…
- CVE-2026-45412 - CVSS 6.3 (medium), 2026-05-26: MaxKB is an open-source AI assistant for enterprise. Prior to 2.9.1, SSRF via work_flow_template Import. Authenticated users can supply arbitrary URLs in…
