Openpanel-Dev Openpanel
16 CVEs affecting Openpanel-Dev Openpanel. Latest disclosed: 2026-09-19. Critical: 1, High: 8.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-93985 | Critical | 9.9 | 2026-09-19 | OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member acc… |
CVE-2026-85610 | High | 8.8 | 2026-09-04 | OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code… |
CVE-2026-85614 | High | 8.6 | 2026-09-04 | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully clien… |
CVE-2026-88890 | High | 8.5 | 2026-09-10 | OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers befo… |
CVE-2026-88891 | High | 8.3 | 2026-09-10 | OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and pub… |
CVE-2026-85613 | High | 8.2 | 2026-09-04 | OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attacke… |
CVE-2026-88893 | High | 7.5 | 2026-09-10 | OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated… |
CVE-2026-85612 | High | 7.5 | 2026-09-04 | OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacke… |
CVE-2026-85609 | High | 7.5 | 2026-09-04 | Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api… |
CVE-2026-77769 | Medium | 6.5 | 2026-08-21 | The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardId(dashboardId). The… |
CVE-2026-85615 | Medium | 6.4 | 2026-09-04 | Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to… |
CVE-2026-85611 | Medium | 6.4 | 2026-09-04 | OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures… |
CVE-2026-93984 | Medium | 5.3 | 2026-09-19 | OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only… |
CVE-2026-93983 | Medium | 5.0 | 2026-09-19 | OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply… |
CVE-2026-88892 | Medium | 5.0 | 2026-09-10 | In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard (apps/api/src/utils/s… |
CVE-2026-93982 | Low | 3.3 | 2026-09-19 | OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attacker… |