1panel

Vendor:

First CVE: Jul 5, 2023 · Active for 3 years

21
Total CVEs
More Total CVEs than 94% of tracked products
5.3
Avg CVEs / Year
Higher CVE frequency than 89% of tracked products
7.7
Avg CVSS
Higher Avg CVSS than 62% of tracked products
0.0%
KEV Rate
Bottom 1%

Trends Over Time

The number and severity of CVEs published that impact 1panel over time

Volume of CVEsAvg CVSS Base Score
First CVE
Jul 5, 2023
3 years ago
Most Recent CVE
Jan 18, 2026
189 days ago

CVE Severity & Scoring

1panel21 CVEs
All CVEs352,719 CVEs
LowMediumHighCritical
Attack Vector
Local0 (0.0%)
Network21 (100.0%)
Unknown0 (0.0%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low19 (90.5%)
High2 (9.5%)
Unknown0 (0.0%)
User Interaction
None16 (76.2%)
Unknown0 (0.0%)
Required5 (23.8%)
Privileges Required
Low5 (23.8%)
High1 (4.8%)
None15 (71.4%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (21 CVEs).

21 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2024-39907CRITICAL
1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to arbitrary file writes,
Jul 18, 20249.859NOYES
CVE-2025-54424CRITICAL
1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTPS protocol used for c
Aug 1, 20259.835NONO
CVE-2024-39911CRITICAL
1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue has been addressed in version 1.10.12-
Jul 18, 20249.831NONO
CVE-2024-2352CRITICAL
A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/to
Mar 10, 20249.830NONO
CVE-2025-56413HIGH
OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitrary commands via the operation parameter to the /api/v2/hosts/ssh/oper
Sep 10, 20258.829NONO
CVE-2023-39966CRITICAL
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server
Aug 10, 20239.829NONO
CVE-2026-23525HIGH
1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting (XSS) vulnerability exists in the 1Panel App Store when viewing applica
Jan 18, 20268.427NONO
CVE-2025-34410HIGH
1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings panel (/settings/panel).
Dec 10, 20257.126NONO
CVE-2023-37477HIGH
1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality. A specially-crafted
Jul 18, 20238.826NONO
CVE-2025-34429HIGH
1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality. The port-change endpoint lacks CSRF defenses
Dec 10, 20257.125NONO
View all 21 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (21 CVEs).

CISA KEV
0 CVEs
0.0% of CVEs· Bottom 1%
Metasploit
0 CVEs
0.0% of CVEs· Bottom 1%
Nuclei
1 CVE
4.8% of CVEs· 97th percentile
ExploitDB
0 CVEs
0.0% of CVEs· Bottom 1%

Social Chatter

Signals from CVEs in this product scope (21 CVEs).

Media Mentions

Signals from CVEs in this product scope (21 CVEs).

Top CNAs Publishing CVEs For 1panel

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
2.0.818.81.2%00
1.9.517.50.3%00
1.4.337.20.6%00