[ Vendor · 7 CVEs ]
1Panel-dev
CVEs affecting 1Panel-dev published in the last 30 days, plus any 1Panel-dev CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-108705 | 11 Oct 2026 | CVSS 4.3 | 1Panel-dev CordysCRMCordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users… | |
| CVE-2026-108700 | 11 Oct 2026 | CVSS 6.5 | 1Panel-dev CordysCRM1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling… | |
| CVE-2026-108701 | 11 Oct 2026 | CVSS 4.3 | 1Panel-dev CordysCRM1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST… | |
| CVE-2026-108702 | 11 Oct 2026 | CVSS 4.3 | 1Panel-dev CordysCRM1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to… | |
| CVE-2026-108703 | 11 Oct 2026 | CVSS 5.4 | 1Panel-dev CordysCRMCordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any… | |
| CVE-2026-108704 | 11 Oct 2026 | CVSS 4.3 | 1Panel-dev CordysCRMCordysCRM through 1.9.3 contains an authorization bypass vulnerability that allows low-privileged authenticated users to skip permission checks by… | |
| CVE-2026-108692 | 11 Oct 2026 | CVSS 6.5 | 1Panel-dev CordysCRM1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source… |