OP
Vendor
Openpanel-dev
32
CVEs
0
On KEV
15
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-116819 New | OP openpanel Openpanel-dev | 8.5 | Oct 26 | OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query |
| CVE-2026-116818 New | OP openpanel Openpanel-dev | 8.2 | Oct 26 | OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket |
| CVE-2026-116817 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board |
| CVE-2026-116815 New | OP openpanel Openpanel-dev | 4.3 | Oct 26 | OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts |
| CVE-2026-116814 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs |
| CVE-2026-116813 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts |
| CVE-2026-116812 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter |
| CVE-2026-116811 New | OP openpanel Openpanel-dev | 8.8 | Oct 26 | OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template |
| CVE-2026-116810 New | OP openpanel Openpanel-dev | 5.3 | Oct 26 | OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences |
| CVE-2026-116809 New | OP openpanel Openpanel-dev | 5.3 | Oct 26 | OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure |
| CVE-2026-116808 New | OP openpanel Openpanel-dev | 7.2 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values |
| CVE-2026-116807 New | OP openpanel Openpanel-dev | 6.5 | Oct 26 | OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query |
| CVE-2026-116806 New | OP openpanel Openpanel-dev | 5.4 | Oct 26 | OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation |
| CVE-2026-116805 New | OP openpanel Openpanel-dev | 4.3 | Oct 26 | OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list |
| CVE-2026-108579 | OP openpanel Openpanel-dev | 4.2 | Oct 10 | OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export |
| CVE-2026-93985 | OP openpanel Openpanel-dev | 9.9 | Sep 19 | OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE |
| CVE-2026-93984 | OP openpanel Openpanel-dev | 5.3 | Sep 19 | OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret |
| CVE-2026-93983 | OP openpanel Openpanel-dev | 5.0 | Sep 19 | OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter |
| CVE-2026-93982 | OP openpanel Openpanel-dev | 3.3 | Sep 19 | OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext |
| CVE-2026-88893 | OP openpanel Openpanel-dev | 7.5 | Sep 10 | OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure |
| CVE-2026-88892 | OP openpanel Openpanel-dev | 5.0 | Sep 10 | OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch |
| CVE-2026-88891 | OP openpanel Openpanel-dev | 8.3 | Sep 10 | OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations |
| CVE-2026-88890 | OP openpanel Openpanel-dev | 8.5 | Sep 10 | OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier |
| CVE-2026-85615 | OP openpanel Openpanel-dev | 6.4 | Sep 4 | Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts |
| CVE-2026-85614 | OP openpanel Openpanel-dev | 8.6 | Sep 4 | OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker |
| CVE-2026-85613 | OP openpanel Openpanel-dev | 8.2 | Sep 4 | OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy |
| CVE-2026-85612 | OP openpanel Openpanel-dev | 7.5 | Sep 4 | OpenPanel before 2.3.0 SSRF via favicon and og endpoints |
| CVE-2026-85611 | OP openpanel Openpanel-dev | 6.4 | Sep 4 | OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures |
| CVE-2026-85610 | OP openpanel Openpanel-dev | 8.8 | Sep 4 | OpenPanel before 2.3.0 Remote Code Execution via chart formulas |
| CVE-2026-85609 | OP openpanel Openpanel-dev | 7.5 | Sep 4 | Openpanel before 2.3.0 SSRF via Site Checker Endpoint |
| CVE-2026-77769 | OP openpanel Openpanel-dev | 6.5 | Aug 21 | OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries |
| CVE-2026-77768 | OP openpanel Openpanel-dev | 6.5 | Aug 21 | OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access |