Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Release: Openpanel-dev openpanel 2.3.0 Clear all filters
TI-2026-58740 CVE-2026-85615 · GHSA-w9vr-cg67-9jp7

Openpanel before 2.3.0 Cross-Tenant IDOR via report.getLayouts

Priority LOW 24

Openpanel before 2.3.0 contains an insecure direct object reference vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to bind dashboardId to the authorized projectId.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00239 Published 2026-09-04 Fixed in 2.3.0 CWE-639
TI-2026-58739 CVE-2026-85614 · GHSA-jx42-589g-c2x6

OpenPanel API before 2.3.0 Unauthenticated SSRF via site-checker

Priority MEDIUM 45

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the GET /tools/site-checker endpoint that accepts a fully client-controlled URL parameter with no private IP filtering or DN…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00263 Published 2026-09-04 Fixed in 2.3.0 CWE-918
TI-2026-58738 CVE-2026-85613 · GHSA-fcgm-pp78-h237

OpenPanel before 2.3.0 Unauthenticated XSS via SVG Favicon Proxy

Priority HIGH 70

OpenPanel before 2.3.0 contains a cross-site scripting vulnerability in the unauthenticated favicon proxy endpoint GET /misc/favicon that allows remote attackers to execute scripts by supplying an SVG file URL.

CVSS 4.0HIGH 8.4 Network No auth User interaction EPSS 0.00395 Published 2026-09-04 Fixed in 2.3.0 CWE-79
TI-2026-58737 CVE-2026-85612 · GHSA-77r3-f9wv-hggf

OpenPanel before 2.3.0 SSRF via favicon and og endpoints

Priority MEDIUM 44

OpenPanel before 2.3.0 contains an unauthenticated server-side request forgery vulnerability in the /misc/favicon and /misc/og endpoints that accept an attacker-supplied url parameter with insufficient validation.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00409 Published 2026-09-04 Fixed in 2.3.0 CWE-918
TI-2026-58736 CVE-2026-85611 · GHSA-2p5w-5398-x2r9

OpenPanel before 2.3.0 Cross-Tenant BOLA via report procedures

Priority MEDIUM 57

OpenPanel before 2.3.0 contains a cross-tenant broken object level authorization vulnerability in the report.getLayouts and report.resetLayout tRPC procedures that fail to scope dashboard queries to the caller's project.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00239 Published 2026-09-04 Fixed in 2.3.0 CWE-639
TI-2026-58735 CVE-2026-85610 · GHSA-hjqf-fjmc-gx29

OpenPanel before 2.3.0 Remote Code Execution via chart formulas

Priority MEDIUM 41

OpenPanel before 2.3.0 fails to properly validate chart formula expressions, allowing authenticated project members with read access to execute arbitrary code by recovering the native JavaScript Function constructor thro…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00707 Published 2026-09-04 Fixed in 2.3.0 CWE-94
TI-2026-58734 CVE-2026-85609 · GHSA-m7f4-qmh8-fvrx

Openpanel before 2.3.0 SSRF via Site Checker Endpoint

Priority HIGH 70

Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery (SSRF) vulnerability in the GET /tools/site-checker endpoint (apps/api/src/controllers/tools.controller.ts).

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.005 Published 2026-09-04 Fixed in 2.3.0 CWE-918