1panel-dev vulnerabilities
87 CVEs and advisories name 1panel-dev as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-64870MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation
- CVE-2026-162231Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgery
- CVE-2026-162221Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgery
- CVE-2026-54149MaxKB MCP tool import validation bypass allows post-authentication remote code execution
- CVE-2026-56779MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parameters
- CVE-2026-105671Panel-dev CordysCRM ModuleFormController ModuleFormService.java save cross site scripting
- CVE-2026-105141Panel-dev CordysCRM RequestParamTrimConfig.java cross site scripting
- CVE-2026-42336MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetch
- CVE-2026-42337MaxKB: Broken Access Control in MaxKB OSS URL Fetch API
- CVE-2026-44847MaxKB: Webhook Trigger Authentication Bypass
- CVE-2026-45412MaxKB: Unauthenticated SSRF via Workflow Template Import
- CVE-2026-45413MaxKB: Unsalted MD5 Password Hashing
- CVE-2026-42335MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancy
- CVE-2026-39426MaxKB: Stored XSS via Unsanitized iframe_render Parsing
- CVE-2026-39425MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Rendering
- CVE-2026-39419MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofing
- CVE-2026-39424MaxKB has CSV Injection in its Application Chat Export Functionality
- CVE-2026-39423Stored XSS via Eval Injection in EchartsRander Component
- CVE-2026-39422MaxKB has Stored XSS via ChatHeadersMiddleware
- CVE-2026-39421MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotect
- CVE-2026-39420MaxKB: Sandbox escape via LD_PRELOAD bypass
- CVE-2026-39418MaxKB: SSRF via sandbox network hook bypass
- CVE-2026-39417MaxKB: RCE via MCP stdio command injection in workflow engine
- CVE-2025-156321Panel-dev MaxKB MdPreview chat.ts cross site scripting
- CVE-2026-61081Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injection
- CVE-2026-61071Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross site scripting
- CVE-2026-61061Panel-dev MaxKB Public Chat static_headers_middleware.py StaticHeadersMiddleware cross site scripting
- CVE-2026-235251panel App Store vulnerable to Cross-site Scripting
- CVE-2025-66446MaxKB has a Python sandbox LD_PRELOAD bypass
- CVE-2025-66419MaxKB vulnerable to privilege escalation through sandbox bypass