Latest high and critical flaws
- CVE-2026-116819 OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because tHigh 8.4 · Oct 26, 2026
- CVE-2026-116818 OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId paramHigh 8.8 · Oct 26, 2026
- CVE-2026-116814 OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email template data to standard output logs.High 7.1 · Oct 26, 2026
- CVE-2026-116813 OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows project-read members and share-link holders to injHigh 7.1 · Oct 26, 2026
- CVE-2026-116812 OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows project-read members to inject SQL by suppHigh 7.1 · Oct 26, 2026
- CVE-2026-116811 OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing High 8.7 · Oct 26, 2026
- CVE-2026-116808 OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parametHigh 8.6 · Oct 26, 2026
- CVE-2026-116807 OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping by injecting unescaped profile filter naHigh 7 · Oct 26, 2026
- CVE-2026-93985 OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member acceCritical 9.4 · Sep 19, 2026
- CVE-2026-88893 OpenPanel through 2.3.0 share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated High 8.7 · Sep 10, 2026
- CVE-2026-88891 OpenPanel through 2.3.0 fails to enforce read-only project access level on 26 of 29 mutating procedures, allowing read-level members to modify, delete, and publHigh 7.2 · Sep 10, 2026
- CVE-2026-88890 OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers beforHigh 8.4 · Sep 10, 2026
- CVE-2026-85614 OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully clientCritical 9.2 · Sep 4, 2026
- CVE-2026-85613 OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackerHigh 8.4 · Sep 4, 2026
- CVE-2026-85612 OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attackerHigh 8.7 · Sep 4, 2026
- CVE-2026-85610 OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code bHigh 8.7 · Sep 4, 2026
- CVE-2026-77769 The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardId(dashboardId).High 7.1 · Aug 21, 2026
- CVE-2026-77768 The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportById(reportId) directly.High 7.1 · Aug 21, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.