# cve.now: Openpanel-dev

The newest entries naming Openpanel-dev as an affected vendor (up to 200), of 32 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-116819](https://cve.now/CVE-2026-116819.md): OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query (CVSS 8.4)
- [CVE-2026-116818](https://cve.now/CVE-2026-116818.md): OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket (CVSS 8.8)
- [CVE-2026-116817](https://cve.now/CVE-2026-116817.md): OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board (CVSS 6.9)
- [CVE-2026-116815](https://cve.now/CVE-2026-116815.md): OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts (CVSS 5.3)
- [CVE-2026-116814](https://cve.now/CVE-2026-116814.md): OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs (CVSS 7.1)
- [CVE-2026-116813](https://cve.now/CVE-2026-116813.md): OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts (CVSS 7.1)
- [CVE-2026-116812](https://cve.now/CVE-2026-116812.md): OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter (CVSS 7.1)
- [CVE-2026-116811](https://cve.now/CVE-2026-116811.md): OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template (CVSS 8.7)
- [CVE-2026-116810](https://cve.now/CVE-2026-116810.md): OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences (CVSS 6.9)
- [CVE-2026-116809](https://cve.now/CVE-2026-116809.md): OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure (CVSS 6.9)
- [CVE-2026-116808](https://cve.now/CVE-2026-116808.md): OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values (CVSS 8.6)
- [CVE-2026-116807](https://cve.now/CVE-2026-116807.md): OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query (CVSS 7.0)
- [CVE-2026-116806](https://cve.now/CVE-2026-116806.md): OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation (CVSS 5.3)
- [CVE-2026-116805](https://cve.now/CVE-2026-116805.md): OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list (CVSS 5.3)
- [CVE-2026-108579](https://cve.now/CVE-2026-108579.md): OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export (CVSS 2.3)
- [CVE-2026-93985](https://cve.now/CVE-2026-93985.md): OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE (CVSS 9.4)
- [CVE-2026-93984](https://cve.now/CVE-2026-93984.md): OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret (CVSS 6.9)
- [CVE-2026-93983](https://cve.now/CVE-2026-93983.md): OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter (CVSS 5.3)
- [CVE-2026-93982](https://cve.now/CVE-2026-93982.md): OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext (CVSS 4.8)
- [CVE-2026-88893](https://cve.now/CVE-2026-88893.md): OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure (CVSS 8.7)
- [CVE-2026-88892](https://cve.now/CVE-2026-88892.md): OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch (CVSS 5.3)
- [CVE-2026-88891](https://cve.now/CVE-2026-88891.md): OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations (CVSS 7.2)
- [CVE-2026-88890](https://cve.now/CVE-2026-88890.md): OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier (CVSS 8.4)
- [CVE-2026-85615](https://cve.now/CVE-2026-85615.md): Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts (CVSS 5.3)
- [CVE-2026-85614](https://cve.now/CVE-2026-85614.md): OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker (CVSS 9.2)
- [CVE-2026-85613](https://cve.now/CVE-2026-85613.md): OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy (CVSS 8.4)
- [CVE-2026-85612](https://cve.now/CVE-2026-85612.md): OpenPanel before 2.3.0 SSRF via favicon and og endpoints (CVSS 8.7)
- [CVE-2026-85611](https://cve.now/CVE-2026-85611.md): OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures (CVSS 5.3)
- [CVE-2026-85610](https://cve.now/CVE-2026-85610.md): OpenPanel before 2.3.0 Remote Code Execution via chart formulas (CVSS 8.7)
- [CVE-2026-85609](https://cve.now/CVE-2026-85609.md): Openpanel before 2.3.0 SSRF via Site Checker Endpoint (CVSS 6.9)
- [CVE-2026-77769](https://cve.now/CVE-2026-77769.md): OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries (CVSS 6.5)
- [CVE-2026-77768](https://cve.now/CVE-2026-77768.md): OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access (CVSS 6.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/openpanel-dev
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.