1P
Product
1panel
21
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 11Medium 4Low 1
Watch
Add 1panel to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-54424 | 9.8 | Aug 1 | 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution Affected: before 2.0.6 |
| CVE-2024-39911 | 9.8 | Jul 18 | 1Panel SQL injection Affected: 1.10.10-lts before 1.10.12-lts |
| CVE-2024-39907 | 9.8 | Jul 18 | a sqlinjection in 1Panel Affected: 1.10.9-lts before 1.10.12-lts |
| CVE-2024-2352 | 9.8 | Mar 10 | 1Panel swap baseApi.UpdateDeviceSwap command injection Affected: before 1.10.2-lts |
| CVE-2023-39966 | 9.8 | Aug 10 | 1Panel arbitrary file write vulnerability exists in the background Affected: 1.4.3 |
| CVE-2025-56413 | 8.8 | Sep 10 | OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitrary commands via the operation parameter to the… Affected: 2.0.8 |
| CVE-2023-37477 | 8.8 | Jul 18 | 1Panel is an open source Linux server operation and maintenance management panel Affected: before 1.4.3 |
| CVE-2023-36458 | 8.8 | Jul 5 | 1Panel is an open source Linux server operation and maintenance management panel Affected: before 1.3.6 |
| CVE-2023-36457 | 8.8 | Jul 5 | 1Panel is an open source Linux server operation and maintenance management panel Affected: before 1.3.6 |
| CVE-2026-23525 | 8.4 | Jan 18 | 1panel App Store vulnerable to Cross-site Scripting Affected: before 1.10.34; 2.0.0 before 2.0.17 |
| CVE-2025-66507 | 7.5 | Dec 9 | 1Panel – CAPTCHA Bypass via Client-Controlled Flag Affected: before 2.0.14 |
| CVE-2024-34352 | 7.5 | May 9 | Arbitrary file write vulnerability in 1Panel Affected: before 1.10.3-lts |
| CVE-2024-24768 | 7.5 | Feb 5 | 1Panel set-cookie is missing the Secure keyword Affected: 1.9.5 |
| CVE-2023-39964 | 7.5 | Aug 10 | 1Panel O&M management panel has a background arbitrary file reading vulnerability Affected: 1.4.3 |
| CVE-2025-34429 | 7.1 | Dec 10 | 1Panel CSRF Web Port Configuration Change Affected: 1.10.33-lts through 2.0.15 |
| CVE-2025-34410 | 7.1 | Dec 10 | 1Panel CSRF in Change Username Functionality Allows Account Lockout Affected: 1.10.33-lts through 2.0.15 |
| CVE-2025-66508 | 6.5 | Dec 9 | 1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers Affected: before 2.0.14 |
| CVE-2024-30257 | 5.9 | Apr 18 | 1Panel's password verification is suspected to have a timing attack vulnerability Affected: before 1.10.3-lts |
| CVE-2025-34430 | 4.3 | Dec 10 | 1Panel CSRF Panel Name Modification Affected: 1.10.33-lts through 2.0.15 |
| CVE-2023-39965 | 4.3 | Aug 10 | 1Panel Unauthorized access in Backend Affected: 1.4.3 |
| CVE-2024-27288 | 3.1 | Mar 6 | 1Panel open source panel project has an unauthorized vulnerability. Affected: before 1.10.1-lts |
Showing 21