1Panel-dev

Records146All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical30CVSS 9.0–10.0

CVSS high43CVSS 7.0–8.9

Exploited now

1Panel-dev records in CISA KEV

No 1Panel-dev vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Jumpserver 24 records HIGH 1panel 21 records HIGH Cloudexplorer Lite 9 records HIGH Sqlbot 8 records HIGH Kubepi 5 records CRITICAL Halo 4 records MEDIUM Cloudexplorer 2 records MEDIUM Cordys Crm 1 record HIGH

Records

146 records

TI-2023-08712 CVE-2023-22463 · GHSA-vjhf-8vqx-vqpq

KubePi's Hardcoded Jwtsigkeys allows malicious actor to login with a forged JWT token

CRITICAL 86

KubePi is a k8s panel.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.69667 Published 2023-01-04 Fixed in 1.6.3 CWE-798

TI-2023-08729 CVE-2023-22480 · GHSA-jxgp-jgh3-8jc8

KubeOperator is vulnerable to unauthorized access to system API

HIGH 84

KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.66768 Published 2023-01-14 No fix listed CWE-285

TI-2026-54047 CVE-2026-77521

MaxKB: Prompt-injectable agent can lead to command execution

HIGH 82

MaxKB is an open-source AI assistant for enterprise.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01049 Published 2026-09-21 Fixed in 2.10.5-lts CWE-250

TI-2025-43180 CVE-2025-70981 · GHSA-qr83-6r38-ch55

CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface…

HIGH 82

CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0037 Published 2026-02-12 No fix listed CWE-89

TI-2024-27040 CVE-2024-40628

Arbitrary File Read in Ansible Playbooks in Jumpserver

HIGH 82

JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00861 Published 2024-07-18 Fixed in 3.10.12 CWE-22

TI-2024-26801 CVE-2024-39907 · GHSA-5grx-v727-qmq6

a sqlinjection in 1Panel

HIGH 82

1Panel is a web-based linux server management control panel.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.29183 Published 2024-07-18 Fixed in 1.10.12-tls CWE-89

TI-2023-22592 CVE-2023-42405 · GHSA-mpjg-3h25-9886

SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute…

HIGH 82

SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService.list(), bareMetalService.list(), and switchService.list().

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01072 Published 2023-09-14 No fix listed CWE-89

TI-2023-20041 CVE-2023-38692

Command injection vulnerability in module management function in CloudExplorer Lite

HIGH 82

CloudExplorer Lite is an open source, lightweight cloud management platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03388 Published 2023-08-04 Fixed in 1.3.1 CWE-78

TI-2026-45288 CVE-2026-63647

CordysCRM SSE Notification Stream Hijack via `/sse/subscribe`

HIGH 81

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00496 Published 2026-09-18 Fixed in 1.7.2 CWE-306

TI-2023-23903 CVE-2023-44397

CloudExplorer Lite permission bypass vulnerability

HIGH 81

CloudExplorer Lite is an open source, lightweight cloud management platform.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00735 Published 2023-10-30 Fixed in 1.4.1 CWE-287

TI-2023-20859 CVE-2023-39966 · GHSA-hf7j-xj3w-87g4

1Panel arbitrary file write vulnerability exists in the background

HIGH 81

1Panel is an open source Linux server operation and maintenance management panel.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00834 Published 2023-08-10 Fixed in 1.5.0 CWE-862

TI-2023-23378 CVE-2023-43652

Non-MFA account takeover via using only SSH public key to login in jumpserver

HIGH 78

JumpServer is an open source bastion host.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00814 Published 2023-09-27 Fixed in 2.28.20, 3.7.1 CWE-862

TI-2026-25397 CVE-2026-32949

SQLBot: SSRF to Arbitrary File Read (AFR) via Rogue MySQL

HIGH 77

SQLBot is an intelligent data query system based on a large language model and RAG.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00454 Published 2026-03-20 Fixed in 1.7.0 CWE-73

TI-2023-22607 CVE-2023-42442

JumpServer session replays download without authentication

HIGH 77

JumpServer is an open source bastion host and a professional operation and maintenance security audit system.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.63027 Published 2023-09-15 Fixed in 3.5.5, 3.6.4 CWE-287

TI-2026-25735 CVE-2026-33324

SQLBot prompt injection allows arbitrary SQL execution and remote code execution

HIGH 76

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00603 Published 2026-05-05 Fixed in 1.7.1 CWE-89

TI-2025-34229 CVE-2025-54424 · GHSA-8j63-96wh-wh3j

1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution

HIGH 76

1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0109 Published 2025-08-01 Fixed in 2.0.6, 0.0.0-20250730021757-04b9cbd87a15 CWE-77

TI-2025-33793 CVE-2025-53928

MaxKB has RCE in MCP call

HIGH 76

MaxKB is an open-source AI assistant for enterprise.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00502 Published 2025-07-17 Fixed in 2.0.0, 1.10.9-lts CWE-94

TI-2024-27041 CVE-2024-40629

Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver

HIGH 76

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01272 Published 2024-07-18 Fixed in 3.10.12 CWE-22

TI-2024-19371 CVE-2024-29202

JumpServer vulnerable to Jinja2 template injection in Ansible leads to RCE in Celery

HIGH 76

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.05939 Published 2024-03-29 No fix listed CWE-94

TI-2024-19370 CVE-2024-29201

JumpServer's insecure Ansible playbook validation leads to RCE in Celery

HIGH 76

JumpServer is an open source bastion host and an operation and maintenance security audit system.

CVSS 3.1CRITICAL 10.0 Network Low privileges No interaction EPSS 0.05987 Published 2024-03-29 No fix listed CWE-94

TI-2023-23377 CVE-2023-43651 · GHSA-4r5x-x283-wm96

Remote code execution on the host system via MongoDB shell in jumpserver

HIGH 76

JumpServer is an open source bastion host.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.02107 Published 2023-09-27 Fixed in 2.28.20, 3.7.1 CWE-94

TI-2024-02187 CVE-2024-2352 · GHSA-x2vg-5wrf-vj6v

1Panel swap baseApi.UpdateDeviceSwap command injection

HIGH 75

A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03044 Published 2024-03-10 Fixed in 1.10.1-lts CWE-77

TI-2023-22909 CVE-2023-42818

SSH public key login without private key challenge if mfa is enabled in jumpserver

HIGH 75

JumpServer is an open source bastion host.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00675 Published 2023-09-27 Fixed in 3.6.5, 3.5.6 CWE-287

TI-2023-22910 CVE-2023-42819

Path traversal in Jumpserver

HIGH 74

JumpServer is an open source bastion host.

CVSS 3.1HIGH 8.9 Network Low privileges User interaction EPSS 0.02215 Published 2023-09-26 Fixed in 3.6.5 CWE-22

TI-2023-20651 CVE-2023-39519

CloudExplorer Lite sensitive information leakage vulnerability

HIGH 74

Cloud Explorer Lite is an open source cloud management platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00754 Published 2023-08-24 Fixed in 1.4.0 CWE-200

Open these records in search →