Openpanel-dev vulnerabilities
32 CVEs and advisories name Openpanel-dev as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-116819OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query
- CVE-2026-116818OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket
- CVE-2026-116817OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board
- CVE-2026-116815OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts
- CVE-2026-116814OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs
- CVE-2026-116813OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts
- CVE-2026-116812OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter
- CVE-2026-116811OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template
- CVE-2026-116810OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences
- CVE-2026-116809OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure
- CVE-2026-116808OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values
- CVE-2026-116807OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query
- CVE-2026-116806OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation
- CVE-2026-116805OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list
- CVE-2026-108579OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export
- CVE-2026-93985OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE
- CVE-2026-93984OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret
- CVE-2026-93983OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter
- CVE-2026-93982OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext
- CVE-2026-88893OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure
- CVE-2026-88892OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch
- CVE-2026-88891OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations
- CVE-2026-88890OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier
- CVE-2026-85615Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts
- CVE-2026-85614OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker
- CVE-2026-85613OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy
- CVE-2026-85612OpenPanel before 2.3.0 SSRF via favicon and og endpoints
- CVE-2026-85611OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures
- CVE-2026-85610OpenPanel before 2.3.0 Remote Code Execution via chart formulas
- CVE-2026-85609Openpanel before 2.3.0 SSRF via Site Checker Endpoint