Openpanel-dev openpanel

• CVE-2026-116819 High 8.5 OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query 0.3%
• CVE-2026-116818 High 8.2 OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket 0.4%
• CVE-2026-116817 Medium 6.5 OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board 0.6%
• CVE-2026-116815 Medium 4.3 OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts 0.2%
• CVE-2026-116814 Medium 6.5 OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs 0.3%
• CVE-2026-116813 Medium 6.5 OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts 0.2%
• CVE-2026-116812 Medium 6.5 OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter 0.2%
• CVE-2026-116811 High 8.8 OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template 0.5%
• CVE-2026-116810 Medium 5.3 OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences 0.2%
• CVE-2026-116809 Medium 5.3 OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure 0.2%
• CVE-2026-116808 High 7.2 OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values 0.4%
• CVE-2026-116807 Medium 6.5 OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query 0.3%
• CVE-2026-116806 Medium 5.4 OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation 0.2%
• CVE-2026-116805 Medium 4.3 OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list 0.2%
• CVE-2026-108579 Medium 4.2 OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export 0.2%
• CVE-2026-93985 Critical 9.9 OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE 0.7%
• CVE-2026-93984 Medium 5.3 OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret 0.4%
• CVE-2026-93983 Medium 5.0 OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter 0.3%
• CVE-2026-93982 Low 3.3 OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext 0.2%
• CVE-2026-88893 High 7.5 OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure 0.5%
• CVE-2026-88892 Medium 5.0 OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch 0.3%
• CVE-2026-88891 High 8.3 OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations 0.4%
• CVE-2026-88890 High 8.5 OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier 0.4%
• CVE-2026-85615 Medium 6.4 Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts 0.2%
• CVE-2026-85614 High 8.6 OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker 0.3%
• CVE-2026-85613 High 8.2 OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy 0.4%
• CVE-2026-85612 High 7.5 OpenPanel before 2.3.0 SSRF via favicon and og endpoints 0.4%
• CVE-2026-85611 Medium 6.4 OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures 0.2%
• CVE-2026-85610 High 8.8 OpenPanel before 2.3.0 Remote Code Execution via chart formulas 0.7%
• CVE-2026-85609 High 7.5 Openpanel before 2.3.0 SSRF via Site Checker Endpoint 0.5%
• CVE-2026-77769 Medium 6.5 OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries 0.4%
• CVE-2026-77768 Medium 6.5 OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access 0.4%