Vendor
1Panel-dev
78 known vulnerabilities in products by 1Panel-dev, 0 of them actively exploited (CISA KEV).
Key figures
78
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
24
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2024-39907 | a sqlinjection in 1Panel | 9.8 | |
| Critical | CVE-2023-22463 | KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token | 9.8 | |
| Critical | CVE-2024-29201 | JumpServer's insecure Ansible playbook validation leads to RCE in Celery | 10.0 | |
| Critical | CVE-2024-29202 | JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery | 10.0 | |
| High | CVE-2023-42442 | JumpServer session replays download without authentication | 8.2 | |
| Critical | CVE-2024-39911 | 1Panel SQL injection | 10.0 | |
| Critical | CVE-2023-22480 | KubeOperator is vulnerable to unauthorized access to system API | 7.3 | |
| Critical | CVE-2023-38692 | Command injection vulnerability in module management function in CloudExplorer Lite | 9.8 | |
| High | CVE-2023-42820 | Random seed leakage in Jumpserver | 7.0 | |
| High | CVE-2023-37477 | Command injection in firewall ip functionality in 1Panel | 7.2 | |
| Critical | CVE-2023-48193 | 1Panel-dev Jumpserver: Code Execution | 9.8 | |
| High | CVE-2023-22478 | KubePi is vulnerable to missing authorization | 7.3 | |
| High | CVE-2023-42819 | Path traversal in Jumpserver | 8.9 | |
| Critical | CVE-2023-43651 | Remote code execution on the host system via MongoDB shell in jumpserver | 8.6 | |
| Critical | CVE-2024-2352 | 1Panel swap baseApi.UpdateDeviceSwap command injection | 6.3 | |
| Critical | CVE-2024-40629 | Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver | 10.0 | |
| High | CVE-2025-56413 | 1Panel: OS Command Injection | 8.8 | |
| High | CVE-2023-36457 | 1Panel vulnerable to command injection when adding container repositories | 6.3 | |
| High | CVE-2023-36458 | 1Panel vulnerable to ommand injection when entering the container terminal | 6.3 | |
| High | CVE-2026-32950 | SQLBot: RCE via SQL Injection in Excel Upload Endpoint | 8.8 | |
| Critical | CVE-2023-42405 | 1Panel-dev Rackshift: SQL Injection | 9.8 | |
| Critical | CVE-2024-40628 | Arbitrary File Read in Ansible Playbooks in Jumpserver | 10.0 | |
| Critical | CVE-2026-33324 | SQLBot prompt injection allows arbitrary SQL execution and remote code execution | 8.8 | |
| Critical | CVE-2025-54424 | 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution | 8.1 | |
| High | CVE-2024-34352 | Arbitrary file write vulnerability in 1Panel | 6.5 |
Products
| Jumpserver | 24 | 0 |
| 1Panel | 21 | 0 |
| CloudExplorer-Dev CloudExplorer-Lite | 9 | 0 |
| SQLBot | 8 | 0 |
| KubeOperator KubePi | 5 | 0 |
| Halo | 4 | 0 |