1Panel-dev has 32 CVEs on record between 2023 and 2026. Disclosure cadence is accelerating: 27 in the last 90 days against 0 in the 90 before. The busiest recent month was September 2026 with 20. The median CVSS is 5.8 (medium), with 4 rated critical. None have a confirmed exploitation report. The dominant weakness classes are CWE-862 (12) and CWE-639 (7). Most affected products: CordysCRM (14), MaxKB (13), github.com/1Panel-dev/1Panel (5).
CVEs per month
Last 12 months, by publish date
1125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/091026/10
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 5.8
- Publish → KEV
- —
- Last 90 days
- 27 prev 0
Weakness classes
Products
- CordysCRM 14
- MaxKB 13
- github.com/1Panel-dev/1Panel 5
32
Total CVEs
4
Critical
0
CISA KEV
0
Exploited
Worst active — by depth score
CVE-2024-39907Critical· 9.81Panel has an SQL injection issue related to the orderBy clause72CVE-2026-77521Critical· 10.0MaxKB is an open-source AI assistant for enterprise67CVE-2026-63647Critical· 9.3CordysCRM is an open source AI-powered customer relationship management system that supports private deployment63CVE-2026-79916Critical· 9.1MaxKB is an open-source AI assistant for enterprise50CVE-2026-76900Medium· 6.8CordysCRM is an open source AI-powered customer relationship management system that supports private deployment50
1Panel-dev vulnerabilities
CVEs affecting 1Panel-dev, newest first. Open any entry for full detail, references, and exploit status.
32 CVEsRSS
CVE-2023-39965Medium· 6.51Panel Arbitrary File Download vulnerability
1Panel Arbitrary File Download vulnerability
▾ Sunlit1Panel-dev · github.com/1Panel-dev/1PanelEPSS 0.44%via OSV
CVE-2023-36458Medium· 6.31Panel vulnerable to command injection when entering the container terminal
1Panel vulnerable to command injection when entering the container terminal
▾ Sunlit1Panel-dev · github.com/1Panel-dev/1PanelEPSS 2.3%via OSV