{"schema_version":1,"title":"1Panel-dev vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 27 vulnerabilities in 1Panel-dev: 8 in the last 7 days and 17 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-77525, was published on 21 September 2026. 3 technologies have a page of their own.","url":"https://junglewise.ai/threats/vendors/1panel-dev","json_url":"https://junglewise.ai/threats/vendors/1panel-dev.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/1panel-dev","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","counts":{"high":3,"all_time":27,"critical":1,"exploited":0,"last_7_days":8,"last_30_days":13,"last_90_days":17,"last_365_days":26},"latest":[{"cve":"CVE-2026-77525","cvss":4.2,"epss":0.002,"slug":"cve-2026-77525-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts","title":"MaxKB chat-record routes authorization bypass in management API","severity":"medium","exploited":false,"published_at":"2026-09-21T21:17:11.463+00:00","url":"https://junglewise.ai/threats/cve-2026-77525-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts"},{"cve":"CVE-2026-77523","cvss":7.4,"epss":0.0026,"slug":"cve-2026-77523-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-version-2","title":"MaxKB cross-workspace model parameter form write","severity":"high","exploited":false,"published_at":"2026-09-21T21:17:11.28+00:00","url":"https://junglewise.ai/threats/cve-2026-77523-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-version-2"},{"cve":"CVE-2026-77522","cvss":4.3,"epss":0.003,"slug":"cve-2026-77522-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-version-2","title":"MaxKB knowledge web-document crawler server-side request forgery","severity":"medium","exploited":false,"published_at":"2026-09-21T21:17:11.12+00:00","url":"https://junglewise.ai/threats/cve-2026-77522-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-version-2"},{"cve":"CVE-2026-77521","cvss":10,"epss":0.0105,"slug":"cve-2026-77521-maxkb-is-an-open-source-ai-assistant-for-enterprise-prior-to","title":"MaxKB command execution in SandboxShellBackend","severity":"critical","exploited":false,"published_at":"2026-09-21T21:17:10.943+00:00","url":"https://junglewise.ai/threats/cve-2026-77521-maxkb-is-an-open-source-ai-assistant-for-enterprise-prior-to"},{"cve":"CVE-2026-77520","cvss":5.4,"epss":0.0023,"slug":"cve-2026-77520-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts","title":"MaxKB authorization bypass in application discovery and invocation","severity":"medium","exploited":false,"published_at":"2026-09-21T21:17:10.787+00:00","url":"https://junglewise.ai/threats/cve-2026-77520-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts"},{"cve":"CVE-2026-77519","cvss":5.4,"epss":0.0024,"slug":"cve-2026-77519-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts","title":"MaxKB expired application API keys remain usable on MCP endpoint","severity":"medium","exploited":false,"published_at":"2026-09-21T21:17:10.633+00:00","url":"https://junglewise.ai/threats/cve-2026-77519-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts"},{"cve":"CVE-2026-77518","cvss":5,"epss":0.0027,"slug":"cve-2026-77518-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts","title":"MaxKB authorization bypass exposes MCP tool configuration","severity":"medium","exploited":false,"published_at":"2026-09-21T21:17:10.477+00:00","url":"https://junglewise.ai/threats/cve-2026-77518-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts"},{"cve":"CVE-2026-77517","cvss":5.4,"epss":0.0023,"slug":"cve-2026-77517-maxkb-is-an-open-source-ai-assistant-for-enterprise-from-version","title":"MaxKB authorization bypass in document and paragraph routes","severity":"medium","exploited":false,"published_at":"2026-09-21T21:17:10.317+00:00","url":"https://junglewise.ai/threats/cve-2026-77517-maxkb-is-an-open-source-ai-assistant-for-enterprise-from-version"},{"cve":"CVE-2026-76901","cvss":5.8,"epss":0.004,"slug":"cve-2026-76901-cordyscrm-is-an-open-source-ai-powered-customer-relationship","title":"CordysCRM authorization bypass in pool lead and account retrieval","severity":"medium","exploited":false,"published_at":"2026-09-18T20:17:21.97+00:00","url":"https://junglewise.ai/threats/cve-2026-76901-cordyscrm-is-an-open-source-ai-powered-customer-relationship"},{"cve":"CVE-2026-76899","cvss":5.7,"epss":0.004,"slug":"cve-2026-76899-cordyscrm-is-an-open-source-ai-powered-customer-relationship","title":"CordysCRM SQL injection via sort parameter","severity":"medium","exploited":false,"published_at":"2026-09-18T20:17:21.6+00:00","url":"https://junglewise.ai/threats/cve-2026-76899-cordyscrm-is-an-open-source-ai-powered-customer-relationship"},{"cve":"CVE-2026-63647","epss":0.005,"slug":"cve-2026-63647-cordyscrm-is-an-open-source-ai-powered-customer-relationship","title":"CordysCRM SSE endpoints authentication bypass","severity":"info","exploited":false,"published_at":"2026-09-18T20:17:20.773+00:00","url":"https://junglewise.ai/threats/cve-2026-63647-cordyscrm-is-an-open-source-ai-powered-customer-relationship"},{"cve":"CVE-2026-63646","epss":0.0066,"slug":"cve-2026-63646-cordyscrm-is-an-open-source-ai-powered-customer-relationship","title":"CordysCRM authentication bypass in MCP form configuration endpoint","severity":"info","exploited":false,"published_at":"2026-09-18T20:17:20.627+00:00","url":"https://junglewise.ai/threats/cve-2026-63646-cordyscrm-is-an-open-source-ai-powered-customer-relationship"},{"cve":"CVE-2026-52745","cvss":5.3,"epss":0.0034,"slug":"cve-2026-52745-cordyscrm-is-an-open-source-ai-powered-customer-relationship","title":"CordysCRM SQL injection in account-pool sorting endpoint","severity":"medium","exploited":false,"published_at":"2026-09-18T20:17:16.337+00:00","url":"https://junglewise.ai/threats/cve-2026-52745-cordyscrm-is-an-open-source-ai-powered-customer-relationship"},{"cve":"CVE-2026-64870","cvss":5.3,"slug":"cve-2026-64870-1panel-dev-maxkb-ssrf-in-updatestoretool","title":"1Panel-dev MaxKB SSRF in UpdateStoreTool","severity":"info","exploited":false,"published_at":"2026-07-30T19:18:35.397+00:00","url":"https://junglewise.ai/threats/cve-2026-64870-1panel-dev-maxkb-ssrf-in-updatestoretool"},{"cve":"CVE-2026-16223","cvss":6.3,"slug":"cve-2026-16223-1panel-dev-cordyscrm-ssrf-in-third-party-edit-endpoint","title":"1Panel-dev CordysCRM SSRF in Third Party Edit Endpoint","severity":"medium","exploited":false,"published_at":"2026-07-19T08:16:43.647+00:00","url":"https://junglewise.ai/threats/cve-2026-16223-1panel-dev-cordyscrm-ssrf-in-third-party-edit-endpoint"},{"cve":"CVE-2026-16222","cvss":6.3,"slug":"cve-2026-16222-1panel-dev-cordyscrm-ssrf-in-tokenservice-via-mkaddress","title":"1Panel-dev CordysCRM SSRF in TokenService via mkAddress","severity":"medium","exploited":false,"published_at":"2026-07-19T08:16:42.62+00:00","url":"https://junglewise.ai/threats/cve-2026-16222-1panel-dev-cordyscrm-ssrf-in-tokenservice-via-mkaddress"},{"cve":"CVE-2026-54149","cvss":8.8,"slug":"cve-2026-54149-1panel-dev-maxkb-command-injection-in-mcp-tool-import","title":"1Panel-dev MaxKB command injection in MCP tool import","severity":"high","exploited":false,"published_at":"2026-07-10T16:16:32.587+00:00","url":"https://junglewise.ai/threats/cve-2026-54149-1panel-dev-maxkb-command-injection-in-mcp-tool-import"},{"cve":"CVE-2026-56779","cvss":6.4,"slug":"cve-2026-56779-1panel-dev-maxkb-ssrf-in-toolserializer-endpoints","title":"1Panel-dev MaxKB SSRF in ToolSerializer endpoints","severity":"medium","exploited":false,"published_at":"2026-06-25T19:16:44.833+00:00","url":"https://junglewise.ai/threats/cve-2026-56779-1panel-dev-maxkb-ssrf-in-toolserializer-endpoints"},{"cve":"CVE-2026-10567","cvss":3.5,"slug":"cve-2026-10567-1panel-dev-cordyscrm-stored-xss-in-moduleformcontroller","title":"1Panel-dev CordysCRM stored XSS in ModuleFormController","severity":"low","exploited":false,"published_at":"2026-06-02T03:16:16.367+00:00","url":"https://junglewise.ai/threats/cve-2026-10567-1panel-dev-cordyscrm-stored-xss-in-moduleformcontroller"},{"cve":"CVE-2026-10514","cvss":2.4,"slug":"cve-2026-10514-1panel-dev-cordyscrm-cross-site-scripting-in","title":"1Panel-dev CordysCRM cross-site scripting in RequestParamTrimConfig","severity":"low","exploited":false,"published_at":"2026-06-02T00:16:36.793+00:00","url":"https://junglewise.ai/threats/cve-2026-10514-1panel-dev-cordyscrm-cross-site-scripting-in"},{"cve":"CVE-2026-45413","cvss":6.9,"slug":"cve-2026-45413-maxkb-unsalted-md5-password-hashing","title":"MaxKB unsalted MD5 password hashing","severity":"info","exploited":false,"published_at":"2026-05-26T21:16:40.233+00:00","url":"https://junglewise.ai/threats/cve-2026-45413-maxkb-unsalted-md5-password-hashing"},{"cve":"CVE-2026-45412","cvss":6.3,"slug":"cve-2026-45412-1panel-dev-maxkb-ssrf-in-workflow-template-import","title":"1Panel-dev MaxKB SSRF in workflow template import","severity":"info","exploited":false,"published_at":"2026-05-26T21:16:40.097+00:00","url":"https://junglewise.ai/threats/cve-2026-45412-1panel-dev-maxkb-ssrf-in-workflow-template-import"},{"cve":"CVE-2026-44847","cvss":7.5,"slug":"cve-2026-44847-maxkb-authentication-bypass-in-webhook-trigger-endpoint","title":"MaxKB authentication bypass in webhook trigger endpoint","severity":"high","exploited":false,"published_at":"2026-05-26T21:16:39.313+00:00","url":"https://junglewise.ai/threats/cve-2026-44847-maxkb-authentication-bypass-in-webhook-trigger-endpoint"},{"cve":"CVE-2026-42337","cvss":5.3,"slug":"cve-2026-42337-1panel-dev-maxkb-broken-access-control-in-oss-url-fetch-api","title":"1Panel-dev MaxKB broken access control in OSS URL fetch API","severity":"info","exploited":false,"published_at":"2026-05-26T21:16:37.317+00:00","url":"https://junglewise.ai/threats/cve-2026-42337-1panel-dev-maxkb-broken-access-control-in-oss-url-fetch-api"},{"cve":"CVE-2026-42336","cvss":5.1,"slug":"cve-2026-42336-1panel-dev-maxkb-ssrf-bypass-in-oss-file-service","title":"1Panel-dev MaxKB SSRF bypass in OSS file service","severity":"info","exploited":false,"published_at":"2026-05-26T21:16:37.17+00:00","url":"https://junglewise.ai/threats/cve-2026-42336-1panel-dev-maxkb-ssrf-bypass-in-oss-file-service"}],"vendor":{"hub":true,"name":"1Panel-dev","slug":"1panel-dev","homepage":"https://1panel.cn/","description":"An open-source development group responsible for the 1Panel Linux control panel.","url":"https://junglewise.ai/threats/vendors/1panel-dev"},"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":5},{"week":"2026-09-21","critical":1,"exploited":0,"vulnerabilities":8}],"most_severe":[{"cve":"CVE-2026-77521","cvss":10,"epss":0.0105,"slug":"cve-2026-77521-maxkb-is-an-open-source-ai-assistant-for-enterprise-prior-to","title":"MaxKB command execution in SandboxShellBackend","severity":"critical","exploited":false,"published_at":"2026-09-21T21:17:10.943+00:00","url":"https://junglewise.ai/threats/cve-2026-77521-maxkb-is-an-open-source-ai-assistant-for-enterprise-prior-to"},{"cve":"CVE-2026-54149","cvss":8.8,"slug":"cve-2026-54149-1panel-dev-maxkb-command-injection-in-mcp-tool-import","title":"1Panel-dev MaxKB command injection in MCP tool import","severity":"high","exploited":false,"published_at":"2026-07-10T16:16:32.587+00:00","url":"https://junglewise.ai/threats/cve-2026-54149-1panel-dev-maxkb-command-injection-in-mcp-tool-import"},{"cve":"CVE-2026-44847","cvss":7.5,"slug":"cve-2026-44847-maxkb-authentication-bypass-in-webhook-trigger-endpoint","title":"MaxKB authentication bypass in webhook trigger endpoint","severity":"high","exploited":false,"published_at":"2026-05-26T21:16:39.313+00:00","url":"https://junglewise.ai/threats/cve-2026-44847-maxkb-authentication-bypass-in-webhook-trigger-endpoint"},{"cve":"CVE-2026-77523","cvss":7.4,"epss":0.0026,"slug":"cve-2026-77523-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-version-2","title":"MaxKB cross-workspace model parameter form write","severity":"high","exploited":false,"published_at":"2026-09-21T21:17:11.28+00:00","url":"https://junglewise.ai/threats/cve-2026-77523-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-version-2"},{"cve":"CVE-2024-34352","cvss":6.5,"epss":0.0219,"slug":"cve-2024-34352-1panel-command-injection-in-container-log-search-api","title":"1Panel command injection in container log search API","severity":"medium","exploited":false,"published_at":"2024-05-09T15:14:24+00:00","url":"https://junglewise.ai/threats/cve-2024-34352-1panel-command-injection-in-container-log-search-api"},{"cve":"CVE-2026-56779","cvss":6.4,"slug":"cve-2026-56779-1panel-dev-maxkb-ssrf-in-toolserializer-endpoints","title":"1Panel-dev MaxKB SSRF in ToolSerializer endpoints","severity":"medium","exploited":false,"published_at":"2026-06-25T19:16:44.833+00:00","url":"https://junglewise.ai/threats/cve-2026-56779-1panel-dev-maxkb-ssrf-in-toolserializer-endpoints"},{"cve":"CVE-2026-16223","cvss":6.3,"slug":"cve-2026-16223-1panel-dev-cordyscrm-ssrf-in-third-party-edit-endpoint","title":"1Panel-dev CordysCRM SSRF in Third Party Edit Endpoint","severity":"medium","exploited":false,"published_at":"2026-07-19T08:16:43.647+00:00","url":"https://junglewise.ai/threats/cve-2026-16223-1panel-dev-cordyscrm-ssrf-in-third-party-edit-endpoint"},{"cve":"CVE-2026-16222","cvss":6.3,"slug":"cve-2026-16222-1panel-dev-cordyscrm-ssrf-in-tokenservice-via-mkaddress","title":"1Panel-dev CordysCRM SSRF in TokenService via mkAddress","severity":"medium","exploited":false,"published_at":"2026-07-19T08:16:42.62+00:00","url":"https://junglewise.ai/threats/cve-2026-16222-1panel-dev-cordyscrm-ssrf-in-tokenservice-via-mkaddress"},{"cve":"CVE-2026-76901","cvss":5.8,"epss":0.004,"slug":"cve-2026-76901-cordyscrm-is-an-open-source-ai-powered-customer-relationship","title":"CordysCRM authorization bypass in pool lead and account retrieval","severity":"medium","exploited":false,"published_at":"2026-09-18T20:17:21.97+00:00","url":"https://junglewise.ai/threats/cve-2026-76901-cordyscrm-is-an-open-source-ai-powered-customer-relationship"},{"cve":"CVE-2026-76899","cvss":5.7,"epss":0.004,"slug":"cve-2026-76899-cordyscrm-is-an-open-source-ai-powered-customer-relationship","title":"CordysCRM SQL injection via sort parameter","severity":"medium","exploited":false,"published_at":"2026-09-18T20:17:21.6+00:00","url":"https://junglewise.ai/threats/cve-2026-76899-cordyscrm-is-an-open-source-ai-powered-customer-relationship"}],"generated_at":"2026-09-26T12:07:00.15149+00:00","technologies":[{"name":"1Panel-dev MaxKB","slug":"maxkb","vulnerabilities":9,"url":"https://junglewise.ai/threats/technologies/maxkb"},{"name":"1Panel-dev 1Panel","slug":"1panel","vulnerabilities":7,"url":"https://junglewise.ai/threats/technologies/1panel"},{"name":"1Panel-dev CordysCRM","slug":"cordyscrm","vulnerabilities":4,"url":"https://junglewise.ai/threats/technologies/cordyscrm"}]}