What’s Vulnerable › Products

Openpanel-dev openpanel vulnerabilities

30 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 30 published in the last 12 months.

Check whether your Openpanel-dev openpanel version is affected

Latest Openpanel-dev openpanel vulnerabilities

• CVE-2026-116819 — OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query (CVSS 8.5)
• CVE-2026-116818 — OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket (CVSS 8.2)
• CVE-2026-116817 — OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board (CVSS 6.5)
• CVE-2026-116815 — OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts (CVSS 4.3)
• CVE-2026-116814 — OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs (CVSS 6.5)
• CVE-2026-116813 — OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts (CVSS 6.5)
• CVE-2026-116812 — OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter (CVSS 6.5)
• CVE-2026-116811 — OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template (CVSS 8.8)
• CVE-2026-116810 — OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences (CVSS 5.3)
• CVE-2026-116809 — OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure (CVSS 5.3)
• CVE-2026-116808 — OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values (CVSS 7.2)
• CVE-2026-116807 — OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query (CVSS 6.5)
• CVE-2026-116806 — OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation (CVSS 5.4)
• CVE-2026-116805 — OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list (CVSS 4.3)
• CVE-2026-108579 — OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export (CVSS 4.2)
• CVE-2026-93985 — OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE (CVSS 9.9)
• CVE-2026-93984 — OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret (CVSS 5.3)
• CVE-2026-93983 — OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter (CVSS 5.0)
• CVE-2026-93982 — OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext (CVSS 3.3)
• CVE-2026-88893 — OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure (CVSS 7.5)
• CVE-2026-88892 — OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch (CVSS 5.0)
• CVE-2026-88891 — OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations (CVSS 8.3)
• CVE-2026-88890 — OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier (CVSS 8.5)
• CVE-2026-85615 — Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts (CVSS 6.4)
• CVE-2026-85614 — OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker (CVSS 8.6)