# 1Panel-dev vulnerabilities Source: https://junglewise.ai/threats/vendors/1panel-dev Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 11 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/1panel-dev.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 34 vulnerabilities in 1Panel-dev: 1 in the last 7 days and 20 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-126496, was published on 11 November 2026. Nothing in the last four weeks, down from 19 vulnerabilities in the four before. 0 critical against 1. 3 technologies have a page of their own. ## Counts - Last 7 days: 1 - Last 30 days: 1 - Last 90 days: 20 - All time: 34 (1 critical, 0 exploited in the wild) ## About 1Panel-dev An open-source development group responsible for the 1Panel Linux control panel. ## Latest 1Panel-dev vulnerabilities - [CVE-2026-126496: 1Panel-dev CordysCRM authorization bypass in CustomerContactController](https://junglewise.ai/threats/cve-2026-126496-1panel-dev-cordyscrm-before-1-9-6-contains-an-authorization) (medium, CVSS 4.3, published 11 Nov 2026) - [CVE-2026-108704: CordysCRM authorization bypass in follow-up record endpoints](https://junglewise.ai/threats/cve-2026-108704-cordyscrm-through-1-9-3-contains-an-authorization-bypass) (medium, CVSS 4.3, published 11 Oct 2026) - [CVE-2026-108703: CordysCRM missing authorization in approval submission](https://junglewise.ai/threats/cve-2026-108703-cordyscrm-through-1-9-3-contains-a-missing-authorization) (medium, CVSS 5.4, published 11 Oct 2026) - [CVE-2026-108702: 1Panel-dev CordysCRM SSRF in webhook test endpoint](https://junglewise.ai/threats/cve-2026-108702-1panel-dev-cordyscrm-through-1-9-3-lacks-a-process-setting) (medium, CVSS 4.3, published 11 Oct 2026) - [CVE-2026-108701: 1Panel-dev CordysCRM authorization bypass in contract sorting](https://junglewise.ai/threats/cve-2026-108701-1panel-dev-cordyscrm-before-1-9-2-contains-a-missing) (medium, CVSS 4.3, published 11 Oct 2026) - [CVE-2026-108700: 1Panel-dev CordysCRM authorization bypass in field listing](https://junglewise.ai/threats/cve-2026-108700-1panel-dev-cordyscrm-before-1-9-2-contains-a-missing) (medium, CVSS 6.5, published 11 Oct 2026) - [CVE-2026-108692: 1Panel CordysCRM missing authorization in ModuleFieldController](https://junglewise.ai/threats/cve-2026-108692-1panel-dev-cordyscrm-from-1-9-0-before-1-9-2-contains-a-missing) (medium, CVSS 6.5, published 11 Oct 2026) - [CVE-2026-77525: MaxKB chat-record routes authorization bypass in management API](https://junglewise.ai/threats/cve-2026-77525-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts) (medium, CVSS 4.2, published 21 Sep 2026) - [CVE-2026-77523: MaxKB cross-workspace model parameter form write](https://junglewise.ai/threats/cve-2026-77523-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-version-2) (high, CVSS 7.4, published 21 Sep 2026) - [CVE-2026-77522: MaxKB knowledge web-document crawler server-side request forgery](https://junglewise.ai/threats/cve-2026-77522-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-version-2) (medium, CVSS 4.3, published 21 Sep 2026) - [CVE-2026-77521: MaxKB command execution in SandboxShellBackend](https://junglewise.ai/threats/cve-2026-77521-maxkb-is-an-open-source-ai-assistant-for-enterprise-prior-to) (critical, CVSS 10, published 21 Sep 2026) - [CVE-2026-77520: MaxKB authorization bypass in application discovery and invocation](https://junglewise.ai/threats/cve-2026-77520-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts) (medium, CVSS 5.4, published 21 Sep 2026) - [CVE-2026-77519: MaxKB expired application API keys remain usable on MCP endpoint](https://junglewise.ai/threats/cve-2026-77519-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts) (medium, CVSS 5.4, published 21 Sep 2026) - [CVE-2026-77518: MaxKB authorization bypass exposes MCP tool configuration](https://junglewise.ai/threats/cve-2026-77518-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-2-10-2-lts) (medium, CVSS 5, published 21 Sep 2026) - [CVE-2026-77517: MaxKB authorization bypass in document and paragraph routes](https://junglewise.ai/threats/cve-2026-77517-maxkb-is-an-open-source-ai-assistant-for-enterprise-from-version) (medium, CVSS 5.4, published 21 Sep 2026) - [CVE-2026-76901: CordysCRM authorization bypass in pool lead and account retrieval](https://junglewise.ai/threats/cve-2026-76901-cordyscrm-is-an-open-source-ai-powered-customer-relationship) (medium, CVSS 5.8, published 18 Sep 2026) - [CVE-2026-76899: CordysCRM SQL injection via sort parameter](https://junglewise.ai/threats/cve-2026-76899-cordyscrm-is-an-open-source-ai-powered-customer-relationship) (medium, CVSS 5.7, published 18 Sep 2026) - [CVE-2026-63647: CordysCRM SSE endpoints authentication bypass](https://junglewise.ai/threats/cve-2026-63647-cordyscrm-is-an-open-source-ai-powered-customer-relationship) (info, published 18 Sep 2026) - [CVE-2026-63646: CordysCRM authentication bypass in MCP form configuration endpoint](https://junglewise.ai/threats/cve-2026-63646-cordyscrm-is-an-open-source-ai-powered-customer-relationship) (info, published 18 Sep 2026) - [CVE-2026-52745: CordysCRM SQL injection in account-pool sorting endpoint](https://junglewise.ai/threats/cve-2026-52745-cordyscrm-is-an-open-source-ai-powered-customer-relationship) (medium, CVSS 5.3, published 18 Sep 2026) - [CVE-2026-64870: 1Panel-dev MaxKB SSRF in UpdateStoreTool](https://junglewise.ai/threats/cve-2026-64870-1panel-dev-maxkb-ssrf-in-updatestoretool) (info, CVSS 5.3, published 30 Jul 2026) - [CVE-2026-16223: 1Panel-dev CordysCRM SSRF in Third Party Edit Endpoint](https://junglewise.ai/threats/cve-2026-16223-1panel-dev-cordyscrm-ssrf-in-third-party-edit-endpoint) (medium, CVSS 6.3, published 19 Jul 2026) - [CVE-2026-16222: 1Panel-dev CordysCRM SSRF in TokenService via mkAddress](https://junglewise.ai/threats/cve-2026-16222-1panel-dev-cordyscrm-ssrf-in-tokenservice-via-mkaddress) (medium, CVSS 6.3, published 19 Jul 2026) - [CVE-2026-54149: 1Panel-dev MaxKB command injection in MCP tool import](https://junglewise.ai/threats/cve-2026-54149-1panel-dev-maxkb-command-injection-in-mcp-tool-import) (high, CVSS 8.8, published 10 Jul 2026) - [CVE-2026-56779: 1Panel-dev MaxKB SSRF in ToolSerializer endpoints](https://junglewise.ai/threats/cve-2026-56779-1panel-dev-maxkb-ssrf-in-toolserializer-endpoints) (medium, CVSS 6.4, published 25 Jun 2026) ## Most severe 1Panel-dev vulnerabilities - [CVE-2026-77521: MaxKB command execution in SandboxShellBackend](https://junglewise.ai/threats/cve-2026-77521-maxkb-is-an-open-source-ai-assistant-for-enterprise-prior-to) (critical, CVSS 10, published 21 Sep 2026) - [CVE-2026-54149: 1Panel-dev MaxKB command injection in MCP tool import](https://junglewise.ai/threats/cve-2026-54149-1panel-dev-maxkb-command-injection-in-mcp-tool-import) (high, CVSS 8.8, published 10 Jul 2026) - [CVE-2026-44847: MaxKB authentication bypass in webhook trigger endpoint](https://junglewise.ai/threats/cve-2026-44847-maxkb-authentication-bypass-in-webhook-trigger-endpoint) (high, CVSS 7.5, published 26 May 2026) - [CVE-2026-77523: MaxKB cross-workspace model parameter form write](https://junglewise.ai/threats/cve-2026-77523-maxkb-is-an-open-source-ai-assistant-for-enterprise-in-version-2) (high, CVSS 7.4, published 21 Sep 2026) - [CVE-2024-34352: 1Panel command injection in container log search API](https://junglewise.ai/threats/cve-2024-34352-1panel-command-injection-in-container-log-search-api) (medium, CVSS 6.5, published 9 May 2024) - [CVE-2026-108700: 1Panel-dev CordysCRM authorization bypass in field listing](https://junglewise.ai/threats/cve-2026-108700-1panel-dev-cordyscrm-before-1-9-2-contains-a-missing) (medium, CVSS 6.5, published 11 Oct 2026) - [CVE-2026-108692: 1Panel CordysCRM missing authorization in ModuleFieldController](https://junglewise.ai/threats/cve-2026-108692-1panel-dev-cordyscrm-from-1-9-0-before-1-9-2-contains-a-missing) (medium, CVSS 6.5, published 11 Oct 2026) - [CVE-2026-56779: 1Panel-dev MaxKB SSRF in ToolSerializer endpoints](https://junglewise.ai/threats/cve-2026-56779-1panel-dev-maxkb-ssrf-in-toolserializer-endpoints) (medium, CVSS 6.4, published 25 Jun 2026) - [CVE-2026-16223: 1Panel-dev CordysCRM SSRF in Third Party Edit Endpoint](https://junglewise.ai/threats/cve-2026-16223-1panel-dev-cordyscrm-ssrf-in-third-party-edit-endpoint) (medium, CVSS 6.3, published 19 Jul 2026) - [CVE-2026-16222: 1Panel-dev CordysCRM SSRF in TokenService via mkAddress](https://junglewise.ai/threats/cve-2026-16222-1panel-dev-cordyscrm-ssrf-in-tokenservice-via-mkaddress) (medium, CVSS 6.3, published 19 Jul 2026) ## Vulnerabilities per week Nothing in the last four weeks, down from 19 vulnerabilities in the four before. 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 5 | 0 | 0 | | 21 Sep 2026 | 8 | 1 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 6 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 1 | 0 | 0 | ## 1Panel-dev technologies - [1Panel-dev MaxKB](https://junglewise.ai/threats/technologies/maxkb): 17 vulnerabilities - [1Panel-dev CordysCRM](https://junglewise.ai/threats/technologies/cordyscrm): 16 vulnerabilities - [1Panel-dev 1Panel](https://junglewise.ai/threats/technologies/1panel): 7 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "1Panel-dev vulnerabilities", https://junglewise.ai/threats/vendors/1panel-dev, 11 November 2026.