Vendor

    1Panel-dev

    86 known vulnerabilities in products by 1Panel-dev, 0 of them actively exploited (CISA KEV).

    Key figures

    86

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    11

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in 1Panel-dev
    CriticalCVE-2024-39907

    a sqlinjection in 1Panel

    also in 2 other products

    		9.8
    CriticalCVE-2024-39911

    1Panel SQL injection

    also in 2 other products

    		10.0
    CriticalCVE-2026-77521

    MaxKB: Prompt-injectable agent can lead to command execution

    		10.0
    MediumCVE-2024-36111

    KubePi's JWT token validation has a defect

    		6.3
    HighCVE-2023-37477

    Command injection in firewall ip functionality in 1Panel

    also in 2 other products

    		7.2
    CriticalCVE-2026-65956

    KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF

    		—
    MediumCVE-2026-6108

    1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injection

    		6.3
    HighCVE-2023-36457

    1Panel vulnerable to command injection when adding container repositories

    also in 2 other products

    		6.3
    HighCVE-2023-36458

    1Panel vulnerable to ommand injection when entering the container terminal

    also in 2 other products

    		6.3
    CriticalCVE-2026-63647

    CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`

    		—
    CriticalCVE-2026-79916

    MaxKB AWS Bedrock model credential injection leads to remote code execution

    		9.1
    MediumCVE-2026-63646

    CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users

    		—
    CriticalCVE-2025-54424

    1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution

    also in 2 other products

    		8.1
    HighCVE-2026-54149

    MaxKB MCP tool import validation bypass allows post-authentication remote code execution

    		8.8
    HighCVE-2024-34352

    Arbitrary file write vulnerability in 1Panel

    also in 2 other products

    		6.5
    MediumCVE-2026-76900

    CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime

    		6.8
    CriticalCVE-2023-37917

    Privilege Escalation in kubepi

    also in 2 other products

    		9.1
    HighCVE-2023-39964

    1Panel O&M management panel has a background arbitrary file reading vulnerability

    also in 2 other products

    		7.5
    MediumCVE-2026-79919

    1Panel-dev MaxKB: Protection Mechanism Failure

    		6.3
    HighCVE-2026-77523

    MaxKB: Cross-workspace model parameter form write

    		7.4
    HighCVE-2026-108692

    1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints

    		6.5
    HighCVE-2026-108700

    1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title

    		6.5
    CriticalCVE-2023-39966

    1Panel arbitrary file write vulnerability exists in the background

    also in 2 other products

    		7.5
    HighCVE-2024-56137

    MaxKB RCE vulnerability in function library

    also in 1 other product

    		6.8
    HighCVE-2026-39420

    MaxKB: Sandbox escape via LD_PRELOAD bypass

    also in 1 other product

    		7.4

    All vulnerabilities in search

    Products

    Products by 1Panel-dev
    1Panel-dev MaxKB470
    1Panel-dev CordysCRM180
    1Panel160
    1Panel-dev KubePi50