https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 19:54:03 +0000 https://cve.radiocsirt.org/vuln/cnvd-2025-17932 cnvd-2025-17932 https://cve.radiocsirt.org/vuln/cnvd-2025-17932 https://cve.radiocsirt.org/vuln/euvd-2026-248946 EUVD-2026-248946 https://cve.radiocsirt.org/vuln/euvd-2026-248946 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54424 <p>1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTPS protocol used for communication between the Core and Agent endpoints has incomplete certificate verification during certificate validation, leading to unauthorized interface access. Due to the presence of numerous command execution or high-privilege interfaces in 1Panel, this results in Remote Code Execution (RCE). This is fixed in version 2.0.6. The CVE has been translated from Simplified Chinese using GitHub Copilot.</p> <p>1Panel is a web interface and MCP Server that manages websites, files, containers, databases, and LLMs on a Linux server. In versions 2.0.5 and below, the HTTPS protocol used for communication between the Core and Agent endpoints has incomplete certificate verification during certificate validation, leading to unauthorized interface access. Due to the presence of numerous command execution or high-privilege interfaces in 1Panel, this results in Remote Code Execution (RCE). This is fixed in version 2.0.6. The CVE has been translated from Simplified Chinese using GitHub Copilot.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-54424 https://cve.radiocsirt.org/vuln/ghsa-8j63-96wh-wh3j <p><strong>Affected:</strong> Go: github.com/1Panel-dev/1Panel/core</p> <p>### Project Address: Project Address [1Panel](https://github.com/1Panel-dev/1Panel) ### Official website: https://www.1panel.cn/ ### Time: 2025 07 26 ### Version: 1panel V2.0.5 ### Vulnerability Summary - First, we introduce the concepts of 1panel v2 Core and Agent. After the new version is released, 1panel adds the node management function, which allows you to control other hosts by adding nodes. - The HTTPS protocol used for communication between the Core and Agent sides did not fully verify the authenticity of the certificate during certificate verification, resulting in unauthorized interfaces. The presence of a large number of command execution or high-privilege interfaces in the 1panel led to RCE.</p> <p></p> <p>### Code audit process</p> <p>1. First we go to the Agent HTTP routing fileagent/init/router/router.go</p> <p></p> <p>2. It was found that the Routersreference function in the function Certificatewas globally checked.agent/middleware/certificate.go</p> <p></p> <p>3. The discovery Certificatefunction determines c.Request.TLS.HandshakeCompletewhether certificate communication has been performed</p> <p></p> <p>4. Since c.Request.TLS.HandshakeCompletethe true or false judgment is determ…</p> <p><strong>Affected:</strong> Go: github.com/1Panel-dev/1Panel/core</p> <p>### Project Address: Project Address [1Panel](https://github.com/1Panel-dev/1Panel) ### Official website: https://www.1panel.cn/ ### Time: 2025 07 26 ### Version: 1panel V2.0.5 ### Vulnerability Summary - First, we introduce the concepts of 1panel v2 Core and Agent. After the new version is released, 1panel adds the node management function, which allows you to control other hosts by adding nodes. - The HTTPS protocol used for communication between the Core and Agent sides did not fully verify the authenticity of the certificate during certificate verification, resulting in unauthorized interfaces. The presence of a large number of command execution or high-privilege interfaces in the 1panel led to RCE.</p> <p></p> <p>### Code audit process</p> <p>1. First we go to the Agent HTTP routing fileagent/init/router/router.go</p> <p></p> <p>2. It was found that the Routersreference function in the function Certificatewas globally checked.agent/middleware/certificate.go</p> <p></p> <p>3. The discovery Certificatefunction determines c.Request.TLS.HandshakeCompletewhether certificate communication has been performed</p> <p></p> <p>4. Since c.Request.TLS.HandshakeCompletethe true or false judgment is determ…</p> https://cve.radiocsirt.org/vuln/ghsa-8j63-96wh-wh3j https://cve.radiocsirt.org/vuln/opensuse-su-2025:15434-1 <p>govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250811T192933-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15434-1