Openpanel-dev Openpanel vulnerabilities

• openpanel-dev openpanel OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query CVE-2026-116819 8.4 HighOctober 26, 2026
• openpanel-dev openpanel OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket CVE-2026-116818 8.8 HighOctober 26, 2026
• openpanel-dev openpanel OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board CVE-2026-116817 6.9 MediumOctober 26, 2026
• openpanel-dev openpanel OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts CVE-2026-116815 5.3 MediumOctober 26, 2026
• openpanel-dev openpanel OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs CVE-2026-116814 7.1 HighOctober 26, 2026
• openpanel-dev openpanel OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts CVE-2026-116813 7.1 HighOctober 26, 2026
• openpanel-dev openpanel OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter CVE-2026-116812 7.1 HighOctober 26, 2026
• openpanel-dev openpanel OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template CVE-2026-116811 8.7 HighOctober 26, 2026
• openpanel-dev openpanel OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences CVE-2026-116810 6.9 MediumOctober 26, 2026
• openpanel-dev openpanel OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure CVE-2026-116809 6.9 MediumOctober 26, 2026
• openpanel-dev openpanel OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values CVE-2026-116808 8.6 HighOctober 26, 2026
• openpanel-dev openpanel OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query CVE-2026-116807 7.0 HighOctober 26, 2026
• openpanel-dev openpanel OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation CVE-2026-116806 5.3 MediumOctober 26, 2026
• openpanel-dev openpanel OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list CVE-2026-116805 5.3 MediumOctober 26, 2026
• openpanel-dev openpanel OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export CVE-2026-108579 2.3 LowOctober 10, 2026
• openpanel-dev openpanel OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE CVE-2026-93985 9.4 CriticalSeptember 19, 2026
• openpanel-dev openpanel OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret CVE-2026-93984 6.9 MediumSeptember 19, 2026
• openpanel-dev openpanel OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter CVE-2026-93983 5.3 MediumSeptember 19, 2026
• openpanel-dev openpanel OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext CVE-2026-93982 4.8 MediumSeptember 19, 2026
• openpanel-dev openpanel OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure CVE-2026-88893 8.7 HighSeptember 10, 2026
• openpanel-dev openpanel OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch CVE-2026-88892 5.3 MediumSeptember 10, 2026
• openpanel-dev openpanel OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations CVE-2026-88891 7.2 HighSeptember 10, 2026
• openpanel-dev openpanel OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier CVE-2026-88890 8.4 HighSeptember 10, 2026
• openpanel-dev openpanel Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts CVE-2026-85615 5.3 MediumSeptember 4, 2026
• openpanel-dev openpanel OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker CVE-2026-85614 9.2 CriticalSeptember 4, 2026
• openpanel-dev openpanel OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy CVE-2026-85613 8.4 HighSeptember 4, 2026
• openpanel-dev openpanel OpenPanel before 2.3.0 SSRF via favicon and og endpoints CVE-2026-85612 Public exploit 8.7 HighSeptember 4, 2026
• openpanel-dev openpanel OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures CVE-2026-85611 5.3 MediumSeptember 4, 2026
• openpanel-dev openpanel OpenPanel before 2.3.0 Remote Code Execution via chart formulas CVE-2026-85610 8.7 HighSeptember 4, 2026
• openpanel-dev openpanel Openpanel before 2.3.0 SSRF via Site Checker Endpoint CVE-2026-85609 6.9 MediumSeptember 4, 2026
• openpanel-dev openpanel OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries CVE-2026-77769 7.1 HighAugust 21, 2026
• openpanel-dev openpanel OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access CVE-2026-77768 7.1 HighAugust 21, 2026