Skip to content
OpenAdvisories

Vendor

1Panel-dev

87 known vulnerabilities.

Products

MaxKB 47 CordysCRM 19 1Panel 16 KubePi 5
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • Critical 10.0
    CVE-2026-77521 Public exploit

    MaxKB: Prompt-injectable agent can lead to command execution

    MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.5-lts, assistants with a tool, MCP tool, skill, or sub-application use SandboxShellBackend, which exposes an execute shell tool without excluding it and omits execute from interrupt_on…

    1Panel-dev MaxKB
  • Critical 9.1
    CVE-2026-79916

    MaxKB AWS Bedrock model credential injection leads to remote code execution

    MaxKB is an open-source AI assistant for enterprise. Prior to 2.10.5-lts, authenticated workspace members can inject control characters into AWS Bedrock access_key_id and secret_access_key fields that _update_aws_credentials writes to /root/.aws/credentials w…

    1Panel-dev MaxKB
  • Critical 9.3
    CVE-2026-63647

    CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`

    CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.2, SseController exposes the anonymous /sse/subscribe, /sse/broadcast, and /sse/close endpoints because ShiroFilter.addPublicPathFilt…

    1Panel-dev CordysCRM
  • Critical 10.0
    CVE-2026-65956

    KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF

    KubePi is a Kubernetes multi-cluster management panel. In versions up to and including 1.6.15, the SSO configuration API endpoints are exposed on the same public routing boundary as the SSO login and callback endpoints, so SSO, OIDC, and SAML management opera…

    1Panel-dev KubePi
  • Critical 10.0
    CVE-2024-39911

    1Panel SQL injection

    1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue has been addressed in version 1.10.12-lts. Users are advised to upgrade. There are no known workarounds for this vuln…

    1Panel-dev 1Panel github.com/1Panel-dev/1Panel Go
  • Critical 9.8
    CVE-2024-39907 EPSS 29%

    a sqlinjection in 1Panel

    1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes, and ultimately leading to RCEs. These sql injections have been resolved in ver…

    1Panel-dev 1Panel github.com/1Panel-dev/1Panel Go
  • Critical 9.1
    CVE-2023-37917

    Privilege Escalation in kubepi

    KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the `isadmin` value in the request. As a result any user may take administrative control of KubePi. This issue has been …

    1Panel-dev KubePi github.com/KubeOperator/kubepi Go