{"items":[{"id":"CVE-2026-116819","published":"2026-10-26T23:05:46.288Z","updated":"2026-11-04T19:05:33.351Z","title":"OpenPanel before 3.0.0 Credential Disclosure via notification.rules Query","severity":"HIGH","score":8.4,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00303,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116818","published":"2026-10-26T23:05:45.602Z","updated":"2026-11-08T14:01:00.490Z","title":"OpenPanel before 3.0.0 Unauthenticated ClickHouse SQL Injection via /live/visitors WebSocket","severity":"HIGH","score":8.8,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.0043,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116817","published":"2026-10-26T23:05:44.806Z","updated":"2026-11-02T18:59:38.557Z","title":"OpenPanel before 3.0.0 Missing Authentication on Worker Bull Board","severity":"MEDIUM","score":6.9,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00565,"kevAdded":null,"exploit":true},{"id":"CVE-2026-116815","published":"2026-10-26T23:05:44.097Z","updated":"2026-10-31T02:10:20.052Z","title":"OpenPanel before 3.0.0 Improper ClickHouse Escaping in sankey.service.ts","severity":"MEDIUM","score":5.3,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.0023,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116814","published":"2026-10-26T23:05:43.404Z","updated":"2026-11-04T19:02:45.267Z","title":"OpenPanel before 3.0.0 Sensitive Information Exposure via Application Logs","severity":"HIGH","score":7.1,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00277,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116813","published":"2026-10-26T23:05:41.783Z","updated":"2026-10-27T14:15:43.266Z","title":"OpenPanel before 3.0.0 ClickHouse SQL Injection via conversion.service.ts","severity":"HIGH","score":7.1,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00234,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116812","published":"2026-10-26T23:05:41.107Z","updated":"2026-11-02T18:45:02.745Z","title":"OpenPanel before 3.0.0 ClickHouse SQL Injection via cohort.preview profile filter","severity":"HIGH","score":7.1,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00234,"kevAdded":null,"exploit":true},{"id":"CVE-2026-116811","published":"2026-10-26T23:05:40.470Z","updated":"2026-10-31T02:08:36.588Z","title":"OpenPanel before 3.0.0 Sandbox Escape RCE via Webhook JavaScript Template","severity":"HIGH","score":8.7,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00494,"kevAdded":null,"exploit":true},{"id":"CVE-2026-116810","published":"2026-10-26T23:05:39.854Z","updated":"2026-11-04T19:07:57.232Z","title":"OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences","severity":"MEDIUM","score":6.9,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.0025,"kevAdded":null,"exploit":true},{"id":"CVE-2026-116809","published":"2026-10-26T23:05:39.208Z","updated":"2026-10-27T14:15:52.170Z","title":"OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure","severity":"MEDIUM","score":6.9,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.0021,"kevAdded":null,"exploit":false},{"id":"CVE-2026-116808","published":"2026-10-26T23:05:38.546Z","updated":"2026-11-02T18:43:10.129Z","title":"OpenPanel before 3.0.0 ClickHouse SQL Injection via profile.values","severity":"HIGH","score":8.6,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00385,"kevAdded":null,"exploit":true},{"id":"CVE-2026-116807","published":"2026-10-26T23:05:37.872Z","updated":"2026-10-31T02:07:19.295Z","title":"OpenPanel before 3.0.0 ClickHouse SQL Injection via event.events tRPC Query","severity":"HIGH","score":7,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00267,"kevAdded":null,"exploit":true},{"id":"CVE-2026-116806","published":"2026-10-26T23:05:37.220Z","updated":"2026-11-04T19:11:48.490Z","title":"OpenPanel before 3.0.0 Privilege Escalation via onboarding.project tRPC Mutation","severity":"MEDIUM","score":5.3,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00238,"kevAdded":null,"exploit":true},{"id":"CVE-2026-116805","published":"2026-10-26T23:05:36.532Z","updated":"2026-10-27T14:15:58.367Z","title":"OpenPanel before 3.0.0 Information Disclosure of Ingestion Secret Hashes via client.list","severity":"MEDIUM","score":5.3,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.0022,"kevAdded":null,"exploit":false},{"id":"CVE-2026-108579","published":"2026-10-10T15:57:48.583Z","updated":"2026-10-14T16:03:21.836Z","title":"OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export","severity":"LOW","score":2.3,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00196,"kevAdded":null,"exploit":false},{"id":"CVE-2026-93985","published":"2026-09-19T11:53:37.061Z","updated":"2026-10-02T14:00:44.881Z","title":"OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE","severity":"CRITICAL","score":9.4,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00666,"kevAdded":null,"exploit":true},{"id":"CVE-2026-93984","published":"2026-09-19T11:53:36.376Z","updated":"2026-10-02T14:00:44.275Z","title":"OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret","severity":"MEDIUM","score":6.9,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00415,"kevAdded":null,"exploit":true},{"id":"CVE-2026-93983","published":"2026-09-19T11:53:35.677Z","updated":"2026-10-02T14:00:43.185Z","title":"OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter","severity":"MEDIUM","score":5.3,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00332,"kevAdded":null,"exploit":true},{"id":"CVE-2026-93982","published":"2026-09-19T11:53:34.982Z","updated":"2026-10-02T14:00:42.472Z","title":"OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext","severity":"MEDIUM","score":4.8,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00167,"kevAdded":null,"exploit":true},{"id":"CVE-2026-88893","published":"2026-09-10T13:05:41.023Z","updated":"2026-10-27T10:14:45.947Z","title":"OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure","severity":"HIGH","score":8.7,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00492,"kevAdded":null,"exploit":false},{"id":"CVE-2026-88892","published":"2026-09-10T13:05:40.244Z","updated":"2026-10-27T10:14:44.458Z","title":"OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch","severity":"MEDIUM","score":5.3,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00331,"kevAdded":null,"exploit":true},{"id":"CVE-2026-88891","published":"2026-09-10T13:05:39.530Z","updated":"2026-10-27T10:14:43.762Z","title":"OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations","severity":"HIGH","score":7.2,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00441,"kevAdded":null,"exploit":true},{"id":"CVE-2026-88890","published":"2026-09-10T13:05:38.816Z","updated":"2026-10-27T10:14:43.087Z","title":"OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier","severity":"HIGH","score":8.4,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00394,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85615","published":"2026-09-04T11:30:10.060Z","updated":"2026-10-27T10:14:42.412Z","title":"Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts","severity":"MEDIUM","score":5.3,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00239,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85614","published":"2026-09-04T11:30:09.411Z","updated":"2026-10-27T10:14:41.767Z","title":"OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker","severity":"CRITICAL","score":9.2,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00263,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85613","published":"2026-09-04T11:30:08.747Z","updated":"2026-10-27T10:14:41.111Z","title":"OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy","severity":"HIGH","score":8.4,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00395,"kevAdded":null,"exploit":true},{"id":"CVE-2026-85612","published":"2026-09-04T11:30:08.089Z","updated":"2026-10-27T10:14:40.402Z","title":"OpenPanel before 2.3.0 SSRF via favicon and og endpoints","severity":"HIGH","score":8.7,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00409,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85611","published":"2026-09-04T11:30:07.432Z","updated":"2026-10-27T10:14:39.718Z","title":"OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures","severity":"MEDIUM","score":5.3,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00239,"kevAdded":null,"exploit":true},{"id":"CVE-2026-85610","published":"2026-09-04T11:30:06.777Z","updated":"2026-10-27T10:14:39.052Z","title":"OpenPanel before 2.3.0 Remote Code Execution via chart formulas","severity":"HIGH","score":8.7,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00707,"kevAdded":null,"exploit":false},{"id":"CVE-2026-85609","published":"2026-09-04T11:30:06.128Z","updated":"2026-10-27T10:14:38.364Z","title":"Openpanel before 2.3.0 SSRF via Site Checker Endpoint","severity":"MEDIUM","score":6.9,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.005,"kevAdded":null,"exploit":true},{"id":"CVE-2026-77769","published":"2026-08-21T11:05:15.644Z","updated":"2026-11-08T14:08:59.637Z","title":"OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries","severity":"HIGH","score":7.1,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00415,"kevAdded":null,"exploit":true},{"id":"CVE-2026-77768","published":"2026-08-21T11:05:14.998Z","updated":"2026-11-08T14:08:58.928Z","title":"OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access","severity":"HIGH","score":7.1,"vendor":"Openpanel-dev","product":"openpanel","kev":false,"epss":0.00415,"kevAdded":null,"exploit":true}]}