agentprime: 1panel-dev-maxkb

agentprime: 1panel-dev-maxkbEvery new CVE for 1panel-dev-maxkb.https://agentprime.io/CVE-2026-79919: MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)https://agentprime.io/advisories/CVE-2026-79919/https://agentprime.io/advisories/CVE-2026-79919/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:48:02 GMTCVECVE-2026-79918: MaxKB: Sandbox escape via unhooked fexecvehttps://agentprime.io/advisories/CVE-2026-79918/https://agentprime.io/advisories/CVE-2026-79918/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:47:13 GMTCVECVE-2026-77517: MaxKB cross-knowledge IDOR lets a normal user read and modify documents and paragraphs in another knowledge basehttps://agentprime.io/advisories/CVE-2026-77517/https://agentprime.io/advisories/CVE-2026-77517/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:46:19 GMTCVECVE-2026-77521: MaxKB: Prompt-injectable agent can lead to command executionhttps://agentprime.io/advisories/CVE-2026-77521/https://agentprime.io/advisories/CVE-2026-77521/CVSS 10.0 (Critical). Critical: CVSS score 10.0: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:45:14 GMTCVEcriticalCVE-2026-77522: MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)https://agentprime.io/advisories/CVE-2026-77522/https://agentprime.io/advisories/CVE-2026-77522/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:44:17 GMTCVECVE-2026-79917: MaxKB: Chat share-link endpoint missing owner check: a chat token can publish another user's conversationhttps://agentprime.io/advisories/CVE-2026-79917/https://agentprime.io/advisories/CVE-2026-79917/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:43:27 GMTCVECVE-2026-77516: MaxKB: Missing per-tool authorization in the agent and workflow tool-dispatch pathhttps://agentprime.io/advisories/CVE-2026-77516/https://agentprime.io/advisories/CVE-2026-77516/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:40:44 GMTCVECVE-2026-77523: MaxKB: Cross-workspace model parameter form writehttps://agentprime.io/advisories/CVE-2026-77523/https://agentprime.io/advisories/CVE-2026-77523/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:39:36 GMTCVECVE-2026-77525: MaxKB: Management chat-record routes trust path application_id but load ChatRecord by global chat_idhttps://agentprime.io/advisories/CVE-2026-77525/https://agentprime.io/advisories/CVE-2026-77525/CVSS 4.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:37:49 GMTCVECVE-2026-77518: MaxKB: Known MCP tool IDs expose owner Tool.code and can be referenced by attacker workflowshttps://agentprime.io/advisories/CVE-2026-77518/https://agentprime.io/advisories/CVE-2026-77518/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:36:26 GMTCVECVE-2026-79916: MaxKB AWS Bedrock model credential injection leads to remote code executionhttps://agentprime.io/advisories/CVE-2026-79916/https://agentprime.io/advisories/CVE-2026-79916/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:34:47 GMTCVEcriticalCVE-2026-77520: MaxKB: Homepage ranking leaks application IDs that workflow application-nodes can use to invoke another user's applicationhttps://agentprime.io/advisories/CVE-2026-77520/https://agentprime.io/advisories/CVE-2026-77520/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:28:08 GMTCVECVE-2026-77519: MaxKB: Expired application API keys remain usable on `/chat/api/mcp`https://agentprime.io/advisories/CVE-2026-77519/https://agentprime.io/advisories/CVE-2026-77519/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 21 Sep 2026 20:26:27 GMTCVECVE-2026-64870: MaxKB: UpdateStoreTool fetches caller-supplied app-store URLs without host validationhttps://agentprime.io/advisories/CVE-2026-64870/https://agentprime.io/advisories/CVE-2026-64870/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 30 Jul 2026 17:01:18 GMTCVECVE-2026-54149: MaxKB MCP tool import validation bypass allows post-authentication remote code executionhttps://agentprime.io/advisories/CVE-2026-54149/https://agentprime.io/advisories/CVE-2026-54149/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 15:05:32 GMTCVECVE-2026-56779: MaxKB < 2.10.0 - Server-Side Request Forgery via downloadCallbackUrl and download_url Parametershttps://agentprime.io/advisories/CVE-2026-56779/https://agentprime.io/advisories/CVE-2026-56779/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Jun 2026 18:11:12 GMTCVECVE-2026-42336: MaxKB: SSRF Bypass via DNS Rebinding in MaxKB OSS URL Fetchhttps://agentprime.io/advisories/CVE-2026-42336/https://agentprime.io/advisories/CVE-2026-42336/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 26 May 2026 20:22:41 GMTCVECVE-2026-42337: MaxKB: Broken Access Control in MaxKB OSS URL Fetch APIhttps://agentprime.io/advisories/CVE-2026-42337/https://agentprime.io/advisories/CVE-2026-42337/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 26 May 2026 20:19:40 GMTCVECVE-2026-44847: MaxKB: Webhook Trigger Authentication Bypasshttps://agentprime.io/advisories/CVE-2026-44847/https://agentprime.io/advisories/CVE-2026-44847/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 26 May 2026 20:16:46 GMTCVECVE-2026-45412: MaxKB: Unauthenticated SSRF via Workflow Template Importhttps://agentprime.io/advisories/CVE-2026-45412/https://agentprime.io/advisories/CVE-2026-45412/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 26 May 2026 20:14:39 GMTCVECVE-2026-45413: MaxKB: Unsalted MD5 Password Hashinghttps://agentprime.io/advisories/CVE-2026-45413/https://agentprime.io/advisories/CVE-2026-45413/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 26 May 2026 20:12:34 GMTCVECVE-2026-42335: MaxKB: SSRF Bypass in MaxKB OSS URL Fetch due to URL Parsing Discrepancyhttps://agentprime.io/advisories/CVE-2026-42335/https://agentprime.io/advisories/CVE-2026-42335/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 26 May 2026 20:09:25 GMTCVECVE-2026-39426: MaxKB: Stored XSS via Unsanitized iframe_render Parsinghttps://agentprime.io/advisories/CVE-2026-39426/https://agentprime.io/advisories/CVE-2026-39426/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 01:25:10 GMTCVECVE-2026-39425: MaxKB: Stored XSS via Unsanitized html_rander Tags in Markdown Renderinghttps://agentprime.io/advisories/CVE-2026-39425/https://agentprime.io/advisories/CVE-2026-39425/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 01:18:42 GMTCVECVE-2026-39419: MaxKB: Sandbox Result Validation Bypass via Tool Output Spoofinghttps://agentprime.io/advisories/CVE-2026-39419/https://agentprime.io/advisories/CVE-2026-39419/CVSS 3.1 (Low). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 01:03:40 GMTCVECVE-2026-39424: MaxKB has CSV Injection in its Application Chat Export Functionalityhttps://agentprime.io/advisories/CVE-2026-39424/https://agentprime.io/advisories/CVE-2026-39424/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 00:56:56 GMTCVECVE-2026-39423: Stored XSS via Eval Injection in EchartsRander Componenthttps://agentprime.io/advisories/CVE-2026-39423/https://agentprime.io/advisories/CVE-2026-39423/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 00:28:47 GMTCVECVE-2026-39422: MaxKB has Stored XSS via ChatHeadersMiddlewarehttps://agentprime.io/advisories/CVE-2026-39422/https://agentprime.io/advisories/CVE-2026-39422/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 00:22:50 GMTCVECVE-2026-39421: MaxKB: Sandbox escape via ctypes and unhooked SYS_pkey_mprotecthttps://agentprime.io/advisories/CVE-2026-39421/https://agentprime.io/advisories/CVE-2026-39421/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 00:17:10 GMTCVECVE-2026-39420: MaxKB: Sandbox escape via LD_PRELOAD bypasshttps://agentprime.io/advisories/CVE-2026-39420/https://agentprime.io/advisories/CVE-2026-39420/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 00:13:01 GMTCVECVE-2026-39418: MaxKB: SSRF via sandbox network hook bypasshttps://agentprime.io/advisories/CVE-2026-39418/https://agentprime.io/advisories/CVE-2026-39418/CVSS 5.0 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 00:08:50 GMTCVECVE-2026-39417: MaxKB: RCE via MCP stdio command injection in workflow enginehttps://agentprime.io/advisories/CVE-2026-39417/https://agentprime.io/advisories/CVE-2026-39417/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 14 Apr 2026 00:03:16 GMTCVECVE-2025-15632: 1Panel-dev MaxKB MdPreview chat.ts cross site scriptinghttps://agentprime.io/advisories/CVE-2025-15632/https://agentprime.io/advisories/CVE-2025-15632/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 13 Apr 2026 09:30:21 GMTCVECVE-2026-6108: 1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injectionhttps://agentprime.io/advisories/CVE-2026-6108/https://agentprime.io/advisories/CVE-2026-6108/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 12 Apr 2026 01:00:19 GMTCVECVE-2026-6107: 1Panel-dev MaxKB ChatHeadersMiddleware chat_headers_middleware.py cross site scriptinghttps://agentprime.io/advisories/CVE-2026-6107/https://agentprime.io/advisories/CVE-2026-6107/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 12 Apr 2026 00:45:18 GMTCVECVE-2026-6106: 1Panel-dev MaxKB Public Chat static_headers_middleware.py StaticHeadersMiddleware cross site scriptinghttps://agentprime.io/advisories/CVE-2026-6106/https://agentprime.io/advisories/CVE-2026-6106/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 11 Apr 2026 22:15:14 GMTCVECVE-2025-66446: MaxKB has a Python sandbox LD_PRELOAD bypasshttps://agentprime.io/advisories/CVE-2025-66446/https://agentprime.io/advisories/CVE-2025-66446/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 11 Dec 2025 21:47:22 GMTCVECVE-2025-66419: MaxKB vulnerable to privilege escalation through sandbox bypasshttps://agentprime.io/advisories/CVE-2025-66419/https://agentprime.io/advisories/CVE-2025-66419/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 11 Dec 2025 21:39:15 GMTCVECVE-2025-64703: MaxKB has Information Leak in sandboxhttps://agentprime.io/advisories/CVE-2025-64703/https://agentprime.io/advisories/CVE-2025-64703/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 13 Nov 2025 15:52:44 GMTCVECVE-2025-64511: MaxKB has SSRF in sandboxhttps://agentprime.io/advisories/CVE-2025-64511/https://agentprime.io/advisories/CVE-2025-64511/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 13 Nov 2025 15:51:53 GMTCVECVE-2025-10433: 1Panel-dev MaxKB debug deserializationhttps://agentprime.io/advisories/CVE-2025-10433/https://agentprime.io/advisories/CVE-2025-10433/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 15 Sep 2025 08:02:06 GMTCVECVE-2025-53928: MaxKB has RCE in MCP callhttps://agentprime.io/advisories/CVE-2025-53928/https://agentprime.io/advisories/CVE-2025-53928/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Jul 2025 13:56:02 GMTCVECVE-2025-53927: MaxKB sandbox bypasshttps://agentprime.io/advisories/CVE-2025-53927/https://agentprime.io/advisories/CVE-2025-53927/CVSS 4.6 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 17 Jul 2025 13:50:18 GMTCVECVE-2025-48950: MaxKB Python Sandbox Bypass in Function Libraryhttps://agentprime.io/advisories/CVE-2025-48950/https://agentprime.io/advisories/CVE-2025-48950/CVSS 5.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Jun 2025 18:16:09 GMTCVECVE-2025-4546: 1Panel-dev MaxKB Knowledge Base Module csv injectionhttps://agentprime.io/advisories/CVE-2025-4546/https://agentprime.io/advisories/CVE-2025-4546/CVSS 5.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 11 May 2025 20:00:06 GMTCVECVE-2025-32383: MaxKB has a reverse shell vulnerability in function libraryhttps://agentprime.io/advisories/CVE-2025-32383/https://agentprime.io/advisories/CVE-2025-32383/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 10 Apr 2025 13:07:12 GMTCVECVE-2024-56137: MaxKB RCE vulnerability in function libraryhttps://agentprime.io/advisories/CVE-2024-56137/https://agentprime.io/advisories/CVE-2024-56137/CVSS 6.8 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Jan 2025 14:26:19 GMTCVE