Vulnerabilidades en 1Panel-dev
86 resultadosCVE-2026-63647CRITICALCordysCRM SSE Notification Stream Hijack via `/sse/subscribe`EPSS 0.5%CVE-2026-54149HIGHMaxKB MCP tool import validation bypass allows post-authentication remote code executionEPSS 0.5%CVE-2026-39420MEDIUMMaxKB: Sandbox escape via LD_PRELOAD bypassEPSS 0.5%CVE-2025-48950MEDIUMMaxKB Python Sandbox Bypass in Function LibraryEPSS 0.5%CVE-2024-27288MEDIUM1Panel open source panel project has an unauthorized vulnerability.EPSS 0.5%CVE-2025-66507HIGH1Panel – CAPTCHA Bypass via Client-Controlled FlagEPSS 0.5%CVE-2026-79916CRITICALMaxKB AWS Bedrock model credential injection leads to remote code executionEPSS 0.4%CVE-2023-39965MEDIUM1Panel Unauthorized access in BackendEPSS 0.4%CVE-2026-69129MEDIUMKubePi: Insufficient per-cluster authorization checks in cluster management APIsEPSS 0.4%CVE-2026-76901MEDIUMCordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accountsEPSS 0.4%CVE-2026-76899MEDIUMCordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`EPSS 0.4%CVE-2026-79919MEDIUMMaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)EPSS 0.4%CVE-2024-30257LOW1Panel's password verification is suspected to have a timing attack vulnerabilityEPSS 0.4%CVE-2026-16223MEDIUM1Panel-dev CordysCRM Third Party Edit Endpoint IntegrationConfigService.java getSqlBotSrc server-side request forgeryEPSS 0.4%CVE-2026-16222MEDIUM1Panel-dev CordysCRM Third Party Endpoint TokenService.java server-side request forgeryEPSS 0.4%CVE-2026-23525MEDIUM1panel App Store vulnerable to Cross-site ScriptingEPSS 0.4%CVE-2026-39424MEDIUMMaxKB has CSV Injection in its Application Chat Export FunctionalityEPSS 0.4%CVE-2026-64870MEDIUMMaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validationEPSS 0.4%CVE-2026-79918MEDIUMMaxKB: Sandbox escape via unhooked fexecveEPSS 0.4%CVE-2025-66446HIGHMaxKB has a Python sandbox LD_PRELOAD bypassEPSS 0.3%