CVE-2026-42463 | High | 8.1 | 2026-05-13 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.8.0, SQLBot contains a Cross-Workspace IDOR (Insecure Direct Obj… |
CVE-2026-33324 | High | 8.8 | 2026-05-05 | SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. In versions 1.7.0 and earlier, the Text2SQL chat interface is vulnerable to… |
CVE-2026-32950 | High | 8.8 | 2026-03-20 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a critical SQL Injection vulnerability in t… |
CVE-2026-32949 | High | 7.5 | 2026-03-20 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.7.0 contain a Server-Side Request Forgery (SSRF) vulner… |
CVE-2026-32622 | High | 8.8 | 2026-03-19 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions 1.5.0 and below contain a Stored Prompt Injection vulnerability th… |
CVE-2026-31864 | Medium | 6.8 | 2026-03-13 | JumpServer is an open source bastion host and an operation and maintenance security audit system. a Server-Side Template Injection (SSTI) vulnerability exists… |
CVE-2026-31798 | Medium | 5.0 | 2026-03-13 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v4.10.16-lts, JumpServer improperly validates certif… |
CVE-2025-15598 | Low | 3.7 | 2026-03-03 | A vulnerability was found in Dataease SQLBot up to 1.5.1. This impacts the function validateEmbedded of the file backend/apps/system/middleware/auth.py of the… |
CVE-2025-15597 | Medium | 6.3 | 2026-03-02 | A vulnerability has been found in Dataease SQLBot up to 1.4.0. This affects an unknown function of the file backend/apps/system/api/assistant.py of the compone… |
CVE-2025-70981 | Critical | 9.8 | 2026-02-12 | CordysCRM 1.4.1 is vulnerable to SQL Injection in the employee list query interface (/user/list) via the departmentIds parameter. |
CVE-2025-69285 | Medium | 6.1 | 2026-01-21 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions prior to 1.5.0 contain a missing authentication vulnerability in t… |
CVE-2026-23525 | Medium | 6.4 | 2026-01-18 | 1Panel is an open-source, web-based control panel for Linux server management. A stored Cross-Site Scripting (XSS) vulnerability exists in the 1Panel App Store… |
CVE-2025-34430 | Medium | 4.3 | 2025-12-10 | 1Panel versions 1.10.33 through 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the panel name management functionality. The affected endpo… |
CVE-2025-34429 | High | 7.1 | 2025-12-10 | 1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the web port configuration functionality. The port-change endpoin… |
CVE-2025-34410 | High | 7.1 | 2025-12-10 | 1Panel versions 1.10.33 - 2.0.15 contain a cross-site request forgery (CSRF) vulnerability in the Change Username functionality available from the settings pan… |
CVE-2025-66508 | Medium | 6.5 | 2025-12-09 | 1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.14 and below use Gin's default configuration which trusts all IP ad… |
CVE-2025-66507 | High | 7.5 | 2025-12-09 | 1Panel is an open-source, web-based control panel for Linux server management. Versions 2.0.13 and below allow an unauthenticated attacker to disable CAPTCHA v… |
CVE-2025-14117 | Medium | 4.3 | 2025-12-06 | A vulnerability has been found in fit2cloud Halo 2.21.10. Impacted is an unknown function. The manipulation leads to cross-site request forgery. The attack may… |
CVE-2025-58044 | Medium | 6.1 | 2025-12-01 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.19 and v4.10.5, The /core/i18n// endpoint uses… |
CVE-2025-62795 | High | 7.1 | 2025-10-30 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to v3.10.21-lts and v4.10.12-lts, a low-privileged auth… |
CVE-2025-62712 | Critical | 9.6 | 2025-10-30 | JumpServer is an open source bastion host and an operation and maintenance security audit system. In JumpServer versions prior to v3.10.20-lts and v4.10.11-lts… |
CVE-2025-56413 | High | 8.8 | 2025-09-10 | OS Command injection vulnerability in function OperateSSH in 1panel 2.0.8 allowing attackers to execute arbitrary commands via the operation parameter to the /… |
CVE-2025-54424 | High | 8.1 | 2025-08-01 | 1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTP… |
CVE-2025-27095 | Medium | 4.3 | 2025-03-31 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to 4.8.0 and 3.10.18, an attacker with a low-privileged… |
CVE-2024-40629 | Critical | 10.0 | 2024-07-18 | JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes… |
CVE-2024-40628 | Critical | 10.0 | 2024-07-18 | JumpServer is an open-source Privileged Access Management (PAM) tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes… |
CVE-2024-39911 | Critical | 10.0 | 2024-07-18 | 1Panel is a web-based linux server management control panel. 1Panel contains an unspecified sql injection via User-Agent handling. This issue has been addresse… |
CVE-2024-39907 | Critical | 9.8 | 2024-07-18 | 1Panel is a web-based linux server management control panel. There are many sql injections in the project, and some of them are not well filtered, leading to a… |
CVE-2024-34352 | Medium | 6.5 | 2024-05-14 | 1Panel is an open source Linux server operation and maintenance management panel. Prior to v1.10.3-lts, there are many command injections in the project, and… |
CVE-2024-30257 | Low | 3.9 | 2024-04-18 | 1Panel is an open source Linux server operation and maintenance management panel. The password verification in the source code uses the != symbol instead hmac… |
CVE-2024-29202 | Critical | 9.9 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can exploit a Jinja2 template injection vulnerabili… |
CVE-2024-29201 | Critical | 9.9 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Attackers can bypass the input validation mechanism in JumpSe… |
CVE-2024-29024 | Medium | 4.6 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system.
An authenticated user can exploit the Insecure Direct Object… |
CVE-2024-29020 | Medium | 4.6 | 2024-03-29 | JumpServer is an open source bastion host and an operation and maintenance security audit system. An authorized attacker can obtain sensitive information conta… |
CVE-2024-2352 | Medium | 6.3 | 2024-03-10 | A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap o… |
CVE-2024-27288 | Medium | 6.3 | 2024-03-06 | 1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.10.1-lts, users can use Burp to obtain unauthorized access… |
CVE-2024-24763 | Medium | 4.3 | 2024-02-20 | JumpServer is an open source bastion host and an operation and maintenance security audit system. Prior to version 3.10.0, attackers can exploit this vulnerabi… |
CVE-2024-24768 | Medium | 6.5 | 2024-02-05 | 1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword… |
CVE-2023-50612 | High | 7.8 | 2024-01-06 | Insecure Permissions vulnerability in fit2cloud Cloud Explorer Lite version 1.4.1, allow local attackers to escalate privileges and obtain sensitive informatio… |
CVE-2023-48193 | Critical | 9.8 | 2023-11-28 | Insecure Permissions vulnerability in JumpServer GPLv3 v.3.8.0 allows a remote attacker to execute arbitrary code via bypassing the command filtering function… |
CVE-2023-46138 | Low | 3.7 | 2023-10-31 | JumpServer is an open source bastion host and maintenance security audit system that complies with 4A specifications. Prior to version 3.8.0, the default email… |
CVE-2023-44397 | High | 7.5 | 2023-10-30 | CloudExplorer Lite is an open source, lightweight cloud management platform. Prior to version 1.4.1, the gateway filter of CloudExplorer Lite uses a controller… |
CVE-2023-46123 | Medium | 5.3 | 2023-10-25 | jumpserver is an open source bastion machine, professional operation and maintenance security audit system that complies with 4A specifications. A flaw in the… |
CVE-2023-43651 | High | 8.5 | 2023-09-27 | JumpServer is an open source bastion host. An authenticated user can exploit a vulnerability in MongoDB sessions to execute arbitrary commands, leading to remo… |
CVE-2023-42818 | Medium | 5.4 | 2023-09-27 | JumpServer is an open source bastion host. When users enable MFA and use a public key for authentication, the Koko SSH server does not verify the corresponding… |
CVE-2023-43652 | High | 8.2 | 2023-09-27 | JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key wit… |
CVE-2023-43650 | High | 8.2 | 2023-09-27 | JumpServer is an open source bastion host. The verification code for resetting user's password is vulnerable to brute-force attacks due to the absence of rate… |
CVE-2023-42820 | High | 7.0 | 2023-09-27 | JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated… |
CVE-2023-42819 | High | 8.9 | 2023-09-27 | JumpServer is an open source bastion host. Logged-in users can access and modify the contents of any file on the system. A user can use the 'Job-Template' menu… |
CVE-2023-42147 | High | 7.5 | 2023-09-20 | An issue in CloudExplorer Lite 1.3.1 allows an attacker to obtain sensitive information via the login key component. |
CVE-2023-42442 | High | 8.2 | 2023-09-15 | JumpServer is an open source bastion host and a professional operation and maintenance security audit system. Starting in version 3.0.0 and prior to versions 3… |
CVE-2023-42405 | Critical | 9.8 | 2023-09-14 | SQL injection vulnerability in FIT2CLOUD RackShift v1.7.1 allows attackers to execute arbitrary code via the `sort` parameter to taskService.list(), bareMetalS… |
CVE-2023-39519 | High | 7.5 | 2023-08-24 | Cloud Explorer Lite is an open source cloud management platform. Prior to version 1.4.0, there is a risk of sensitive information leakage in the user informati… |
CVE-2023-39966 | High | 7.5 | 2023-08-10 | 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct… |
CVE-2023-39965 | Medium | 6.5 | 2023-08-10 | 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, authenticated attackers can download arbitrary files throug… |
CVE-2023-39964 | High | 7.5 | 2023-08-10 | 1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, arbitrary file reads allow an attacker to read arbitrary im… |
CVE-2023-38692 | Critical | 9.8 | 2023-08-04 | CloudExplorer Lite is an open source, lightweight cloud management platform. Versions prior to 1.3.1 contain a command injection vulnerability in the installat… |
CVE-2023-37917 | Critical | 9.1 | 2023-07-21 | KubePi is an opensource kubernetes management panel. A normal user has permission to create/update users, they can become admin by editing the `isadmin` value… |
CVE-2023-37916 | Medium | 6.5 | 2023-07-21 | KubePi is an opensource kubernetes management panel. The endpoint /kubepi/api/v1/users/search?pageNum=1&&pageSize=10 leak password hash of any user (including… |
CVE-2023-37477 | High | 7.2 | 2023-07-18 | 1Panel is an open source Linux server operation and maintenance management panel. An OS command injection vulnerability exists in 1Panel firewall functionality… |
CVE-2023-36458 | Medium | 6.3 | 2023-07-05 | 1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious paylo… |
CVE-2023-36457 | Medium | 6.3 | 2023-07-05 | 1Panel is an open source Linux server operation and maintenance management panel. Prior to version 1.3.6, an authenticated attacker can craft a malicious paylo… |
CVE-2023-34240 | Medium | 6.5 | 2023-06-27 | Cloudexplorer-lite is an open source cloud software stack. Weak passwords can be easily guessed and are an easy target for brute force attacks. This can lead t… |
CVE-2023-3423 | High | 8.8 | 2023-06-27 | Weak Password Requirements in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v 1.2.0. |
CVE-2023-32316 | High | 7.1 | 2023-05-26 | CloudExplorer Lite is an open source cloud management tool. In affected versions users can add themselves to any organization in CloudExplorer Lite. This is du… |
CVE-2023-32311 | High | 7.1 | 2023-05-26 | CloudExplorer Lite is an open source cloud management platform. In CloudExplorer Lite prior to version 1.1.0 users organization/workspace permissions are not p… |
CVE-2022-42225 | Medium | 5.4 | 2023-05-24 | Jumpserver 2.10.0 <= version <= 2.26.0 contains multiple stored XSS vulnerabilities because of improper filtering of user input, which can execute any javascri… |
CVE-2023-2845 | High | 8.1 | 2023-05-23 | Improper Access Control in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0. |
CVE-2023-2844 | Medium | 4.9 | 2023-05-23 | Authorization Bypass Through User-Controlled Key in GitHub repository cloudexplorer-dev/cloudexplorer-lite prior to v1.1.0. |
CVE-2023-28110 | Medium | 5.7 | 2023-03-16 | Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, refactoring coco's SSH/SFTP service and We… |
CVE-2023-22480 | High | 7.3 | 2023-01-14 | KubeOperator is an open source Kubernetes distribution focused on helping enterprises plan, deploy and operate production-level K8s clusters. In KubeOperator v… |
CVE-2023-22478 | High | 7.3 | 2023-01-14 | KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1… |
CVE-2023-22479 | High | 7.5 | 2023-01-10 | KubePi is a modern Kubernetes panel. A session fixation attack allows an attacker to hijack a legitimate user session, versions 1.6.3 and below are susceptible… |
CVE-2023-22463 | Critical | 9.8 | 2023-01-04 | KubePi is a k8s panel. The jwt authentication function of KubePi through version 1.6.2 uses hard-coded Jwtsigkeys, resulting in the same Jwtsigkeys for all onl… |
CVE-2022-28074 | Medium | 4.8 | 2022-04-22 | Halo-1.5.0 was discovered to contain a stored cross-site scripting (XSS) vulnerability via \admin\index.html#/system/tools. |
CVE-2022-22124 | Medium | 5.4 | 2022-01-13 | In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the profile image. An authenticated attacker can upload a c… |
CVE-2022-22123 | Medium | 5.4 | 2022-01-13 | In Halo, versions v1.0.0 to v1.4.17 (latest) are vulnerable to Stored Cross-Site Scripting (XSS) in the article title. An authenticated attacker can inject arb… |