What’s Vulnerable › Products

1Panel-dev 1Panel vulnerabilities

21 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your 1Panel-dev 1Panel version is affected

Latest 1Panel-dev 1Panel vulnerabilities

• CVE-2026-23525 — 1panel App Store vulnerable to Cross-site Scripting (CVSS 8.4)
• CVE-2025-34430 — 1Panel CSRF Panel Name Modification (CVSS 4.3)
• CVE-2025-34429 — 1Panel CSRF Web Port Configuration Change (CVSS 7.1)
• CVE-2025-34410 — 1Panel CSRF in Change Username Functionality Allows Account Lockout (CVSS 7.1)
• CVE-2025-66508 — 1Panel IP Access Control Bypass via Untrusted X-Forwarded-For Headers (CVSS 6.5)
• CVE-2025-66507 — 1Panel – CAPTCHA Bypass via Client-Controlled Flag (CVSS 7.5)
• CVE-2025-56413 — (CVSS 8.8)
• CVE-2025-54424 — 1Panel Agent Bypasses Certificate Verification Leading to Arbitrary Command Execution (CVSS 9.8)
• CVE-2024-39911 — 1Panel SQL injection (CVSS 9.8)
• CVE-2024-39907 — a sqlinjection in 1Panel (CVSS 9.8)
• CVE-2024-34352 — Arbitrary file write vulnerability in 1Panel (CVSS 7.5)
• CVE-2024-30257 — 1Panel's password verification is suspected to have a timing attack vulnerability (CVSS 5.9)
• CVE-2024-2352 — 1Panel swap baseApi.UpdateDeviceSwap command injection (CVSS 9.8)
• CVE-2024-27288 — 1Panel open source panel project has an unauthorized vulnerability. (CVSS 3.1)
• CVE-2024-24768 — 1Panel set-cookie is missing the Secure keyword (CVSS 7.5)
• CVE-2023-39966 — 1Panel arbitrary file write vulnerability exists in the background (CVSS 9.8)
• CVE-2023-39965 — 1Panel Unauthorized access in Backend (CVSS 4.3)
• CVE-2023-39964 — 1Panel O&M management panel has a background arbitrary file reading vulnerability (CVSS 7.5)
• CVE-2023-37477 — Command injection in firewall ip functionality in 1Panel (CVSS 8.8)
• CVE-2023-36458 — 1Panel vulnerable to ommand injection when entering the container terminal (CVSS 8.8)
• CVE-2023-36457 — 1Panel vulnerable to command injection when adding container repositories (CVSS 8.8)