# 1Panel-dev CordysCRM vulnerabilities Source: https://junglewise.ai/threats/technologies/cordyscrm Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 02:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/cordyscrm.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 16 vulnerabilities in 1Panel-dev CordysCRM: 1 in the last 7 days and 12 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126496, was published on 11 November 2026. Nothing in the last four weeks, down from 11 vulnerabilities in the four before. ## Counts - Last 7 days: 1 - Last 30 days: 1 - Last 90 days: 12 - All time: 16 (0 critical, 0 exploited in the wild) ## About 1Panel-dev CordysCRM A customer relationship management application. ## Latest 1Panel-dev CordysCRM vulnerabilities - [CVE-2026-126496: 1Panel-dev CordysCRM authorization bypass in CustomerContactController](https://junglewise.ai/threats/cve-2026-126496-1panel-dev-cordyscrm-before-1-9-6-contains-an-authorization) (medium, CVSS 4.3, published 11 Nov 2026) - [CVE-2026-108704: CordysCRM authorization bypass in follow-up record endpoints](https://junglewise.ai/threats/cve-2026-108704-cordyscrm-through-1-9-3-contains-an-authorization-bypass) (medium, CVSS 4.3, published 11 Oct 2026) - [CVE-2026-108703: CordysCRM missing authorization in approval submission](https://junglewise.ai/threats/cve-2026-108703-cordyscrm-through-1-9-3-contains-a-missing-authorization) (medium, CVSS 5.4, published 11 Oct 2026) - [CVE-2026-108702: 1Panel-dev CordysCRM SSRF in webhook test endpoint](https://junglewise.ai/threats/cve-2026-108702-1panel-dev-cordyscrm-through-1-9-3-lacks-a-process-setting) (medium, CVSS 4.3, published 11 Oct 2026) - [CVE-2026-108701: 1Panel-dev CordysCRM authorization bypass in contract sorting](https://junglewise.ai/threats/cve-2026-108701-1panel-dev-cordyscrm-before-1-9-2-contains-a-missing) (medium, CVSS 4.3, published 11 Oct 2026) - [CVE-2026-108700: 1Panel-dev CordysCRM authorization bypass in field listing](https://junglewise.ai/threats/cve-2026-108700-1panel-dev-cordyscrm-before-1-9-2-contains-a-missing) (medium, CVSS 6.5, published 11 Oct 2026) - [CVE-2026-108692: 1Panel CordysCRM missing authorization in ModuleFieldController](https://junglewise.ai/threats/cve-2026-108692-1panel-dev-cordyscrm-from-1-9-0-before-1-9-2-contains-a-missing) (medium, CVSS 6.5, published 11 Oct 2026) - [CVE-2026-76901: CordysCRM authorization bypass in pool lead and account retrieval](https://junglewise.ai/threats/cve-2026-76901-cordyscrm-is-an-open-source-ai-powered-customer-relationship) (medium, CVSS 5.8, published 18 Sep 2026) - [CVE-2026-76899: CordysCRM SQL injection via sort parameter](https://junglewise.ai/threats/cve-2026-76899-cordyscrm-is-an-open-source-ai-powered-customer-relationship) (medium, CVSS 5.7, published 18 Sep 2026) - [CVE-2026-63647: CordysCRM SSE endpoints authentication bypass](https://junglewise.ai/threats/cve-2026-63647-cordyscrm-is-an-open-source-ai-powered-customer-relationship) (info, published 18 Sep 2026) - [CVE-2026-63646: CordysCRM authentication bypass in MCP form configuration endpoint](https://junglewise.ai/threats/cve-2026-63646-cordyscrm-is-an-open-source-ai-powered-customer-relationship) (info, published 18 Sep 2026) - [CVE-2026-52745: CordysCRM SQL injection in account-pool sorting endpoint](https://junglewise.ai/threats/cve-2026-52745-cordyscrm-is-an-open-source-ai-powered-customer-relationship) (medium, CVSS 5.3, published 18 Sep 2026) - [CVE-2026-16223: 1Panel-dev CordysCRM SSRF in Third Party Edit Endpoint](https://junglewise.ai/threats/cve-2026-16223-1panel-dev-cordyscrm-ssrf-in-third-party-edit-endpoint) (medium, CVSS 6.3, published 19 Jul 2026) - [CVE-2026-16222: 1Panel-dev CordysCRM SSRF in TokenService via mkAddress](https://junglewise.ai/threats/cve-2026-16222-1panel-dev-cordyscrm-ssrf-in-tokenservice-via-mkaddress) (medium, CVSS 6.3, published 19 Jul 2026) - [CVE-2026-10567: 1Panel-dev CordysCRM stored XSS in ModuleFormController](https://junglewise.ai/threats/cve-2026-10567-1panel-dev-cordyscrm-stored-xss-in-moduleformcontroller) (low, CVSS 3.5, published 2 Jun 2026) - [CVE-2026-10514: 1Panel-dev CordysCRM cross-site scripting in RequestParamTrimConfig](https://junglewise.ai/threats/cve-2026-10514-1panel-dev-cordyscrm-cross-site-scripting-in) (low, CVSS 2.4, published 2 Jun 2026) ## Most severe 1Panel-dev CordysCRM vulnerabilities - [CVE-2026-108700: 1Panel-dev CordysCRM authorization bypass in field listing](https://junglewise.ai/threats/cve-2026-108700-1panel-dev-cordyscrm-before-1-9-2-contains-a-missing) (medium, CVSS 6.5, published 11 Oct 2026) - [CVE-2026-108692: 1Panel CordysCRM missing authorization in ModuleFieldController](https://junglewise.ai/threats/cve-2026-108692-1panel-dev-cordyscrm-from-1-9-0-before-1-9-2-contains-a-missing) (medium, CVSS 6.5, published 11 Oct 2026) - [CVE-2026-16223: 1Panel-dev CordysCRM SSRF in Third Party Edit Endpoint](https://junglewise.ai/threats/cve-2026-16223-1panel-dev-cordyscrm-ssrf-in-third-party-edit-endpoint) (medium, CVSS 6.3, published 19 Jul 2026) - [CVE-2026-16222: 1Panel-dev CordysCRM SSRF in TokenService via mkAddress](https://junglewise.ai/threats/cve-2026-16222-1panel-dev-cordyscrm-ssrf-in-tokenservice-via-mkaddress) (medium, CVSS 6.3, published 19 Jul 2026) - [CVE-2026-76901: CordysCRM authorization bypass in pool lead and account retrieval](https://junglewise.ai/threats/cve-2026-76901-cordyscrm-is-an-open-source-ai-powered-customer-relationship) (medium, CVSS 5.8, published 18 Sep 2026) - [CVE-2026-76899: CordysCRM SQL injection via sort parameter](https://junglewise.ai/threats/cve-2026-76899-cordyscrm-is-an-open-source-ai-powered-customer-relationship) (medium, CVSS 5.7, published 18 Sep 2026) - [CVE-2026-108703: CordysCRM missing authorization in approval submission](https://junglewise.ai/threats/cve-2026-108703-cordyscrm-through-1-9-3-contains-a-missing-authorization) (medium, CVSS 5.4, published 11 Oct 2026) - [CVE-2026-52745: CordysCRM SQL injection in account-pool sorting endpoint](https://junglewise.ai/threats/cve-2026-52745-cordyscrm-is-an-open-source-ai-powered-customer-relationship) (medium, CVSS 5.3, published 18 Sep 2026) - [CVE-2026-108702: 1Panel-dev CordysCRM SSRF in webhook test endpoint](https://junglewise.ai/threats/cve-2026-108702-1panel-dev-cordyscrm-through-1-9-3-lacks-a-process-setting) (medium, CVSS 4.3, published 11 Oct 2026) - [CVE-2026-108704: CordysCRM authorization bypass in follow-up record endpoints](https://junglewise.ai/threats/cve-2026-108704-cordyscrm-through-1-9-3-contains-an-authorization-bypass) (medium, CVSS 4.3, published 11 Oct 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 11 vulnerabilities in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 5 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 6 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## Other 1Panel-dev technologies - [1Panel-dev MaxKB](https://junglewise.ai/threats/technologies/maxkb): 17 vulnerabilities - [1Panel-dev 1Panel](https://junglewise.ai/threats/technologies/1panel): 7 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "1Panel-dev CordysCRM vulnerabilities", https://junglewise.ai/threats/technologies/cordyscrm, 11 November 2026.