CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,503 CVEs published, 360 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,503
Show in the list
Critical, last 7 days
360
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product openpanel_dev:openpanel. Show all products

18 CVEs, showing 1 to 18
CVESeverityTitlePublished
CVE-2026-77768Medium 6.5OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access
Assigned by VulnCheck
Aug 21, 2026
CVE-2026-77769Medium 6.5OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries
Assigned by VulnCheck
Aug 21, 2026
CVE-2026-85609High 7.5Openpanel before 2.3.0 SSRF via Site Checker Endpoint
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85610High 8.8OpenPanel before 2.3.0 Remote Code Execution via chart formulas
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85611Medium 6.4OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85612High 7.5OpenPanel before 2.3.0 SSRF via favicon and og endpoints
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85613High 8.2OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85614High 8.6OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-85615Medium 6.4Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts
Assigned by VulnCheck
Sep 4, 2026
CVE-2026-88890High 8.5OpenPanel through 2.3.0 SQL Injection via unvalidated profile filter column identifier
Assigned by VulnCheck
Sep 10, 2026
CVE-2026-88891High 8.3OpenPanel through 2.3.0 Read-Only Access Level Enforcement Bypass via Mutations
Assigned by VulnCheck
Sep 10, 2026
CVE-2026-88892Medium 5.0OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch
Assigned by VulnCheck
Sep 10, 2026
CVE-2026-88893High 7.5OpenPanel through 2.3.0 Unauthenticated Share Lookup Information Disclosure
Assigned by VulnCheck
Sep 10, 2026
CVE-2026-93982Low 3.3OpenPanel through 2.3.0 MCP Authentication Token in Query Parameter Logged Plaintext
Assigned by VulnCheck
Sep 19, 2026
CVE-2026-93983Medium 5.0OpenPanel through 2.3.0 SQL Injection via ClickHouse Property Key Filter
Assigned by VulnCheck
Sep 19, 2026
CVE-2026-93984Medium 5.3OpenPanel API through 2.3.0 Authentication Bypass via Unverified Client Secret
Assigned by VulnCheck
Sep 19, 2026
CVE-2026-93985Critical 9.9OpenPanel js-runtime through 2.3.0 JavaScript Template Sandbox Escape RCE
Assigned by VulnCheck
Sep 19, 2026
CVE-2026-108579Medium 4.2OpenPanel through 2.3.0 CSV Formula Injection via Cohort Member Export
Assigned by VulnCheck
Oct 10, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.