Vulnerabilidades en 1Panel-dev
86 resultadosCVE-2026-52745MEDIUMCordysCRM: Customer Public Pool Sorting Field SQL InjectionEPSS 0.3%CVE-2025-10433MEDIUM1Panel-dev MaxKB debug deserializationEPSS 0.3%CVE-2025-66419HIGHMaxKB vulnerable to privilege escalation through sandbox bypassEPSS 0.3%CVE-2024-24768MEDIUM1Panel set-cookie is missing the Secure keywordEPSS 0.3%CVE-2026-77522MEDIUMMaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)EPSS 0.3%CVE-2026-56779MEDIUMMaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url ParametersEPSS 0.3%CVE-2025-32383MEDIUMMaxKB has a reverse shell vulnerability in function libraryEPSS 0.3%CVE-2026-76902MEDIUMCordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`EPSS 0.3%CVE-2026-44847HIGHMaxKB: Webhook Trigger Authentication BypassEPSS 0.3%CVE-2026-77518MEDIUMMaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflowsEPSS 0.3%CVE-2025-53927MEDIUMMaxKB sandbox bypassEPSS 0.3%CVE-2026-79917MEDIUMMaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversationEPSS 0.3%CVE-2025-15632MEDIUM1Panel-dev MaxKB MdPreview chat.ts cross site scriptingEPSS 0.3%CVE-2026-6106MEDIUM1Panel-dev MaxKB Public Chat static_headers_middleware.py StaticHeadersMiddleware cross site scriptingEPSS 0.3%CVE-2026-39421MEDIUMMaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotectEPSS 0.3%CVE-2026-77523HIGHMaxKB: Cross-workspace model parameter form writeEPSS 0.3%CVE-2025-66508MEDIUM1Panel IP Access Control Bypass via Untrusted X-Forwarded-For HeadersEPSS 0.3%CVE-2026-10514MEDIUM1Panel-dev CordysCRM RequestParamTrimConfig.java cross site scriptingEPSS 0.3%CVE-2026-39417MEDIUMMaxKB: RCE via MCP stdio command injection in workflow engineEPSS 0.2%CVE-2026-77516MEDIUMMaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch pathEPSS 0.2%