4 CVEs publicados el 2026-10-27 · CVSS máximo 8.8/10.
Producto afectado
OpenPanel 3.0.0
CVEs de este lote
| CVE | Severidad | CVSS | EPSS | Estado | Descripción |
|---|---|---|---|---|---|
| CVE-2026-116811 | HIGH | 8.8 | — | OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. | |
| CVE-2026-116819 | HIGH | 8.5 | — | OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips… | |
| CVE-2026-116818 | HIGH | 8.2 | — | OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers to inject SQL through the projectId parameter of the /live/visitors/:projectId… | |
| CVE-2026-116808 | HIGH | 7.2 | — | OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. |