OP
Product
openpanel
32
CVEs
0
On KEV
9.9
Max CVSS
15
New 30D
Severity mix
Critical 1High 12Medium 18Low 1
Watch
Add openpanel to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-93985 | 9.9 | Sep 19 | OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE Affected: through 2.3.0 |
| CVE-2026-116811 New | 8.8 | Oct 26 | OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template Affected: before 3.0.0 |
| CVE-2026-85610 | 8.8 | Sep 4 | OpenPanel before 2.3.0 Remote Code Execution via chart formulas Affected: before 2.3.0 |
| CVE-2026-85614 | 8.6 | Sep 4 | OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker Affected: before 2.3.0 |
| CVE-2026-116819 New | 8.5 | Oct 26 | OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query Affected: before 3.0.0 |
| CVE-2026-88890 | 8.5 | Sep 10 | OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier Affected: through 2.3.0 |
| CVE-2026-88891 | 8.3 | Sep 10 | OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations Affected: through 2.3.0 |
| CVE-2026-116818 New | 8.2 | Oct 26 | OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket Affected: before 3.0.0 |
| CVE-2026-85613 | 8.2 | Sep 4 | OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy Affected: before 2.3.0 |
| CVE-2026-88893 | 7.5 | Sep 10 | OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure Affected: through 2.3.0 |
| CVE-2026-85612 | 7.5 | Sep 4 | OpenPanel before 2.3.0 SSRF via favicon and og endpoints Affected: before 2.3.0 |
| CVE-2026-85609 | 7.5 | Sep 4 | Openpanel before 2.3.0 SSRF via Site Checker Endpoint Affected: before 2.3.0 |
| CVE-2026-116808 New | 7.2 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values Affected: before 3.0.0 |
| CVE-2026-116817 New | 6.5 | Oct 26 | OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board Affected: before 3.0.0 |
| CVE-2026-116814 New | 6.5 | Oct 26 | OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs Affected: before 3.0.0 |
| CVE-2026-116813 New | 6.5 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts Affected: before 3.0.0 |
| CVE-2026-116812 New | 6.5 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter Affected: before 3.0.0 |
| CVE-2026-116807 New | 6.5 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query Affected: before 3.0.0 |
| CVE-2026-77769 | 6.5 | Aug 21 | OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries Affected: before 0a51b6805eed0b3da8376175acd5fa3d26819cb6 |
| CVE-2026-77768 | 6.5 | Aug 21 | OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access Affected: before 0a51b6805eed0b3da8376175acd5fa3d26819cb6 |
| CVE-2026-85615 | 6.4 | Sep 4 | Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts Affected: before 2.3.0 |
| CVE-2026-85611 | 6.4 | Sep 4 | OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures Affected: before 2.3.0 |
| CVE-2026-116806 New | 5.4 | Oct 26 | OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation Affected: before 3.0.0 |
| CVE-2026-116810 New | 5.3 | Oct 26 | OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences Affected: before 3.0.0 |
| CVE-2026-116809 New | 5.3 | Oct 26 | OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure Affected: before 3.0.0 |
| CVE-2026-93984 | 5.3 | Sep 19 | OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret Affected: through 2.3.0 |
| CVE-2026-93983 | 5.0 | Sep 19 | OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter Affected: through 2.3.0 |
| CVE-2026-88892 | 5.0 | Sep 10 | OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch Affected: through 2.3.0 |
| CVE-2026-116815 New | 4.3 | Oct 26 | OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts Affected: before 3.0.0 |
| CVE-2026-116805 New | 4.3 | Oct 26 | OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list Affected: before 3.0.0 |
| CVE-2026-108579 | 4.2 | Oct 10 | OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export Affected: through 2.3.0 |
| CVE-2026-93982 | 3.3 | Sep 19 | OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext Affected: through 2.3.0 |
Showing 32