11Panel-dev

Products

Exploited and recent CVEs

• CVE-2026-108705 Medium 4.3 CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import 0.2%
• CVE-2026-108704 Medium 4.3 CordysCRM through 1.9.3 Authorization Bypass via Follow-Up Record Add Endpoints 0.2%
• CVE-2026-108703 Medium 5.4 CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push 0.2%
• CVE-2026-108702 Medium 4.3 CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test 0.2%
• CVE-2026-108701 Medium 4.3 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort 0.2%
• CVE-2026-108700 Medium 6.5 1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title 0.2%
• CVE-2026-108692 Medium 6.5 1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints 0.2%
• CVE-2026-79919 Medium 6.3 MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT) 0.4%
• CVE-2026-79918 Medium 6.3 MaxKB: Sandbox escape via unhooked fexecve 0.4%
• CVE-2026-77517 Medium 5.4 MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge base 0.2%
• CVE-2026-77521 Critical 10.0 MaxKB: Prompt-injectable agent can lead to command execution 1.0%
• CVE-2026-77522 Medium 4.3 MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind) 0.3%
• CVE-2026-79917 Medium 6.5 MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversation 0.3%
• CVE-2026-77516 Medium 5.4 MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch path 0.2%
• CVE-2026-77523 High 7.4 MaxKB: Cross-workspace model parameter form write 0.3%
• CVE-2026-77525 Medium 4.2 MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_id 0.2%
• CVE-2026-77518 Medium 5.0 MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflows 0.3%
• CVE-2026-79916 Critical 9.1 MaxKB AWS Bedrock model credential injection leads to remote code execution 0.4%
• CVE-2026-77520 Medium 5.4 MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's application 0.2%
• CVE-2026-77519 Medium 5.4 MaxKB: Expired application API keys remain usable on `/chat/api/mcp` 0.2%
• CVE-2026-76899 Medium 5.7 CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page` 0.4%
• CVE-2026-76902 Medium 5.0 CordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}` 0.3%
• CVE-2026-76900 Medium 6.8 CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime 0.5%
• CVE-2026-76901 Medium 5.8 CordysCRM: Broken object-level authorization in lead pool and account pool detail endpoints exposes arbitrary leads and accounts 0.4%
• CVE-2026-63647 Critical 9.3 CordysCRM SSE Notification Stream Hijack via `/sse/subscribe` 0.5%
• CVE-2026-63646 Medium 6.9 CordysCRM MCP Form Configuration Endpoint Exposed to Anonymous Users 0.7%
• CVE-2026-52745 Medium 5.3 CordysCRM: Customer Public Pool Sorting Field SQL Injection 0.3%
• CVE-2026-65956 Critical 10.0 KubePi: Unauthenticated SSO/OIDC configuration allows admin account takeover and SSRF 0.6%
• CVE-2026-69129 Medium 5.8 KubePi: Insufficient per-cluster authorization checks in cluster management APIs 0.4%
• CVE-2026-64870 Medium 5.3 MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validation 0.4%