Vulnerabilidades em 1Panel-dev

79 resultados
Análise Vexday

Com 53 CVEs catalogadas e nenhuma registrada no catálogo KEV da CISA, o 1Panel-dev apresenta taxa de exploração ativa abaixo da média geral do catálogo, o que sugere pressão ofensiva ainda limitada — embora 6 vulnerabilidades já contem com PoC pública, elevando o risco de aproveitamento oportunista. O volume de 23 falhas surgidas nos últimos 90 dias indica ritmo acelerado de descoberta recente, exigindo atenção contínua ao ciclo de patching. O tipo de falha predominante é CWE-79 (Cross-Site Scripting), padrão que frequentemente viabiliza ataques de injeção de conteúdo e sequestro de sessão em interfaces web. A CVE mais crítica no momento é CVE-2024-39907, com escore EPSS de 0,294, valor que a posiciona entre as de maior probabilidade de exploração no portfólio e que deve ser priorizada em qualquer ciclo de remediação.

CVE-2025-64703MEDIUMMaxKB has Information Leak in sandboxEPSS 0.2%CVE-2026-39426MEDIUMMaxKB: Stored XSS via Unsanitized iframe_render ParsingEPSS 0.2%CVE-2026-42336MEDIUMMaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL FetchEPSS 0.2%CVE-2026-39425MEDIUMMaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown RenderingEPSS 0.2%CVE-2026-39423MEDIUMStored XSS via Eval Injection in EchartsRander ComponentEPSS 0.2%CVE-2026-45413MEDIUMMaxKB: Unsalted MD5 Password HashingEPSS 0.1%CVE-2026-77518MEDIUMMaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflowsEPSS —CVE-2026-77517MEDIUMMaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge baseEPSS —CVE-2026-79917MEDIUMMaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversationEPSS —CVE-2026-77519MEDIUMMaxKB: Expired application API keys remain usable on `/chat/api/mcp`EPSS —CVE-2026-79916CRITICALMaxKB AWS Bedrock model credential injection leads to remote code executionEPSS —CVE-2026-79919MEDIUMMaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)EPSS —CVE-2026-77516MEDIUMMaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch pathEPSS —CVE-2026-77522MEDIUMMaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)EPSS —CVE-2026-77523HIGHMaxKB: Cross-workspace model parameter form writeEPSS —CVE-2026-79918MEDIUMMaxKB: Sandbox escape via unhooked fexecveEPSS —CVE-2026-77521CRITICALMaxKB: Prompt-injectable agent can lead to command executionEPSS —CVE-2026-77520MEDIUMMaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's applicationEPSS —CVE-2026-77525MEDIUMMaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_idEPSS —