Vendor

    Openpanel-dev

    32 known vulnerabilities in products by Openpanel-dev, 0 of them actively exploited (CISA KEV).

    Key figures

    32

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    2

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Openpanel-dev
    CriticalCVE-2026-93985

    OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE

    		9.9
    HighCVE-2026-85610

    OpenPanel before 2.3.0 Remote Code Execution via chart formulas

    		8.8
    HighCVE-2026-116811

    OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template

    		8.8
    HighCVE-2026-116818

    OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket

    		8.2
    HighCVE-2026-88893

    OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure

    		7.5
    HighCVE-2026-116808

    OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values

    		7.2
    HighCVE-2026-88891

    OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations

    		8.3
    HighCVE-2026-85612

    OpenPanel before 2.3.0 SSRF via favicon and og endpoints

    		7.5
    HighCVE-2026-88890

    OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier

    		8.5
    HighCVE-2026-85609

    Openpanel before 2.3.0 SSRF via Site Checker Endpoint

    		7.5
    HighCVE-2026-116819

    OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query

    		8.5
    HighCVE-2026-85613

    OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy

    		8.2
    CriticalCVE-2026-85614

    OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker

    		8.6
    MediumCVE-2026-93984

    OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret

    		5.3
    HighCVE-2026-77769

    OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries

    		6.5
    HighCVE-2026-77768

    OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access

    		6.5
    HighCVE-2026-116814

    OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs

    		6.5
    HighCVE-2026-116807

    OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query

    		6.5
    MediumCVE-2026-116817

    OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board

    		6.5
    HighCVE-2026-116813

    OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts

    		6.5
    HighCVE-2026-116812

    OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter

    		6.5
    MediumCVE-2026-116810

    OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences

    		5.3
    MediumCVE-2026-116809

    OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure

    		5.3
    MediumCVE-2026-93983

    OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter

    		5.0
    MediumCVE-2026-85615

    Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts

    		6.4

    All vulnerabilities in search

    Products

    Products by Openpanel-dev
    Openpanel320