Approved changes feed: RSS · Atom
cpe:2.3:a:openpanel:openpanel:-:*:*:*:*:*:*:*
part: a version: - update: *
| Vendor | Openpanel (d6fec2e6-d75a-52b1-b038-71f9669db872) |
|---|---|
| Product | Openpanel (e7b38af4-ed0b-5ae8-8fa0-daa673a3b5d4) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/openpanel-dev/openpanel |
purl2cpe | 2026-09-09 08:34:10.812456 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-93982 |
vulnerable | 2026-10-13 12:28:56.232999 |
OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext
LOW (3.3)
OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.
Published: 2026-09-19T11:53:34.982Z
Updated: 2026-10-02T14:00:42.472Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-93983 |
vulnerable | 2026-10-13 12:28:56.079950 |
OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter
MEDIUM (5)
OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.
Published: 2026-09-19T11:53:35.677Z
Updated: 2026-10-02T14:00:43.185Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-93985 |
vulnerable | 2026-10-13 12:28:55.949997 |
OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE
CRITICAL (9.9)
OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.
Published: 2026-09-19T11:53:37.061Z
Updated: 2026-10-02T14:00:44.881Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-93984 |
vulnerable | 2026-10-13 12:28:55.907965 |
OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret
MEDIUM (5.3)
OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.
Published: 2026-09-19T11:53:36.376Z
Updated: 2026-10-02T14:00:44.275Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-88890 |
vulnerable | 2026-09-16 04:34:09.154532 |
OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier
HIGH (8.5)
OpenPanel through 2.3.0 contains an SQL injection vulnerability in the analytics filter builder that fails to validate profile.* filter column identifiers before interpolating them into ClickHouse WHERE clauses. An authenticated attacker with project-scoped read or root export credentials can inject arbitrary ClickHouse SQL to bypass project isolation and read other organizations' analytics data and profile PII via blind boolean oracle techniques.
Published: 2026-09-10T13:05:38.816Z
Updated: 2026-10-02T14:00:39.976Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.