# OpenPanel vulnerabilities Source: https://junglewise.ai/threats/vendors/openpanel Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/openpanel.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 23 vulnerabilities in OpenPanel: 0 in the last 7 days and 23 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116818, was published on 27 October 2026. 10 vulnerabilities in the last four weeks, up 233% on the four before (3). 0 critical against 1. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 10 - Last 90 days: 23 - All time: 23 (1 critical, 0 exploited in the wild) ## About OpenPanel Web hosting control panel software for server and domain management. ## Latest OpenPanel vulnerabilities - [CVE-2026-116818: OpenPanel ClickHouse SQL injection](https://junglewise.ai/threats/cve-2026-116818-openpanel-before-3-0-0-contains-an-unauthenticated-clickhouse) (high, CVSS 8.2, published 27 Oct 2026) - [CVE-2026-116817: OpenPanel missing authentication in Bull Board](https://junglewise.ai/threats/cve-2026-116817-openpanel-before-3-0-0-contains-a-missing-authentication) (medium, CVSS 6.5, published 27 Oct 2026) - [CVE-2026-116815: OpenPanel improper escaping in sankey.service.ts](https://junglewise.ai/threats/cve-2026-116815-openpanel-before-3-0-0-contains-an-improper-escaping) (medium, CVSS 4.3, published 27 Oct 2026) - [CVE-2026-116814: OpenPanel information exposure through logs](https://junglewise.ai/threats/cve-2026-116814-openpanel-before-3-0-0-contains-an-information-exposure) (medium, CVSS 6.5, published 27 Oct 2026) - [CVE-2026-116812: OpenPanel SQL injection in cohort profile filter](https://junglewise.ai/threats/cve-2026-116812-openpanel-before-3-0-0-contains-a-sql-injection-vulnerability-in) (medium, CVSS 6.5, published 27 Oct 2026) - [CVE-2026-116811: OpenPanel sandbox escape in JavaScript template validator](https://junglewise.ai/threats/cve-2026-116811-openpanel-before-3-0-0-contains-a-sandbox-escape-vulnerability) (high, CVSS 8.8, published 27 Oct 2026) - [CVE-2026-116809: OpenPanel missing authorization in event.bots tRPC procedure](https://junglewise.ai/threats/cve-2026-116809-openpanel-before-3-0-0-contains-a-missing-authorization) (medium, CVSS 5.3, published 27 Oct 2026) - [CVE-2026-116807: OpenPanel SQL injection in event filtering](https://junglewise.ai/threats/cve-2026-116807-openpanel-before-3-0-0-contains-an-sql-injection-vulnerability) (medium, CVSS 6.5, published 27 Oct 2026) - [CVE-2026-116806: OpenPanel missing authorization in onboarding.project](https://junglewise.ai/threats/cve-2026-116806-openpanel-before-3-0-0-contains-a-missing-authorization) (medium, CVSS 5.4, published 27 Oct 2026) - [CVE-2026-116805: OpenPanel information disclosure via client.list](https://junglewise.ai/threats/cve-2026-116805-openpanel-before-3-0-0-contains-an-information-disclosure) (medium, CVSS 4.3, published 27 Oct 2026) - [CVE-2026-108579: OpenPanel CSV formula injection](https://junglewise.ai/threats/cve-2026-108579-openpanel-through-2-3-0-contains-a-csv-formula-injection) (medium, CVSS 4.2, published 10 Oct 2026) - [CVE-2026-93985: OpenPanel js-runtime sandbox escape in JavaScript webhook validator](https://junglewise.ai/threats/cve-2026-93985-openpanel-js-runtime-through-commit-bad75bdd-contains-a-sandbox) (critical, CVSS 9.9, published 19 Sep 2026) - [CVE-2026-93983: OpenPanel SQL injection in ClickHouse property key filtering](https://junglewise.ai/threats/cve-2026-93983-openpanel-through-commit-bad75bdd-fails-to-escape-property-keys) (medium, CVSS 5, published 19 Sep 2026) - [CVE-2026-88892: OpenPanel SSRF in data importer via unguarded fetch](https://junglewise.ai/threats/cve-2026-88892-openpanel-ssrf-in-data-importer-via-unguarded-fetch) (medium, CVSS 5, published 10 Sep 2026) - [CVE-2026-88891: OpenPanel privilege escalation in mutation resolvers via missing access level validation](https://junglewise.ai/threats/cve-2026-88891-openpanel-privilege-escalation-in-mutation-resolvers-via-missing) (high, CVSS 8.3, published 10 Sep 2026) - [CVE-2026-85615: Openpanel cross-tenant IDOR in report layout handlers](https://junglewise.ai/threats/cve-2026-85615-openpanel-cross-tenant-idor-in-report-layout-handlers) (medium, CVSS 6.4, published 4 Sep 2026) - [CVE-2026-85614: OpenPanel unauthenticated SSRF in site-checker](https://junglewise.ai/threats/cve-2026-85614-openpanel-unauthenticated-ssrf-in-site-checker) (high, CVSS 8.6, published 4 Sep 2026) - [CVE-2026-85613: OpenPanel unauthenticated XSS in SVG favicon proxy](https://junglewise.ai/threats/cve-2026-85613-openpanel-unauthenticated-xss-in-svg-favicon-proxy) (high, CVSS 8.2, published 4 Sep 2026) - [CVE-2026-85612: OpenPanel server-side request forgery in favicon and OG endpoints](https://junglewise.ai/threats/cve-2026-85612-openpanel-server-side-request-forgery-in-favicon-and-og-endpoints) (high, CVSS 7.5, published 4 Sep 2026) - [CVE-2026-85611: OpenPanel cross-tenant broken object level authorization in report procedures](https://junglewise.ai/threats/cve-2026-85611-openpanel-cross-tenant-broken-object-level-authorization-in) (medium, CVSS 6.4, published 4 Sep 2026) - [CVE-2026-85610: OpenPanel chart formula code injection via mathjs](https://junglewise.ai/threats/cve-2026-85610-openpanel-chart-formula-code-injection-via-mathjs) (high, CVSS 8.8, published 4 Sep 2026) - [CVE-2026-85609: Openpanel site-checker unauthenticated SSRF](https://junglewise.ai/threats/cve-2026-85609-openpanel-site-checker-unauthenticated-ssrf) (high, CVSS 7.5, published 4 Sep 2026) - [CVE-2026-77769: OpenPanel authorization bypass in report listing](https://junglewise.ai/threats/cve-2026-77769-openpanel-authorization-bypass-in-report-listing) (medium, CVSS 6.5, published 21 Aug 2026) ## Most severe OpenPanel vulnerabilities - [CVE-2026-93985: OpenPanel js-runtime sandbox escape in JavaScript webhook validator](https://junglewise.ai/threats/cve-2026-93985-openpanel-js-runtime-through-commit-bad75bdd-contains-a-sandbox) (critical, CVSS 9.9, published 19 Sep 2026) - [CVE-2026-85610: OpenPanel chart formula code injection via mathjs](https://junglewise.ai/threats/cve-2026-85610-openpanel-chart-formula-code-injection-via-mathjs) (high, CVSS 8.8, published 4 Sep 2026) - [CVE-2026-116811: OpenPanel sandbox escape in JavaScript template validator](https://junglewise.ai/threats/cve-2026-116811-openpanel-before-3-0-0-contains-a-sandbox-escape-vulnerability) (high, CVSS 8.8, published 27 Oct 2026) - [CVE-2026-85614: OpenPanel unauthenticated SSRF in site-checker](https://junglewise.ai/threats/cve-2026-85614-openpanel-unauthenticated-ssrf-in-site-checker) (high, CVSS 8.6, published 4 Sep 2026) - [CVE-2026-88891: OpenPanel privilege escalation in mutation resolvers via missing access level validation](https://junglewise.ai/threats/cve-2026-88891-openpanel-privilege-escalation-in-mutation-resolvers-via-missing) (high, CVSS 8.3, published 10 Sep 2026) - [CVE-2026-85613: OpenPanel unauthenticated XSS in SVG favicon proxy](https://junglewise.ai/threats/cve-2026-85613-openpanel-unauthenticated-xss-in-svg-favicon-proxy) (high, CVSS 8.2, published 4 Sep 2026) - [CVE-2026-116818: OpenPanel ClickHouse SQL injection](https://junglewise.ai/threats/cve-2026-116818-openpanel-before-3-0-0-contains-an-unauthenticated-clickhouse) (high, CVSS 8.2, published 27 Oct 2026) - [CVE-2026-85609: Openpanel site-checker unauthenticated SSRF](https://junglewise.ai/threats/cve-2026-85609-openpanel-site-checker-unauthenticated-ssrf) (high, CVSS 7.5, published 4 Sep 2026) - [CVE-2026-85612: OpenPanel server-side request forgery in favicon and OG endpoints](https://junglewise.ai/threats/cve-2026-85612-openpanel-server-side-request-forgery-in-favicon-and-og-endpoints) (high, CVSS 7.5, published 4 Sep 2026) - [CVE-2026-77769: OpenPanel authorization bypass in report listing](https://junglewise.ai/threats/cve-2026-77769-openpanel-authorization-bypass-in-report-listing) (medium, CVSS 6.5, published 21 Aug 2026) ## Vulnerabilities per week 10 vulnerabilities in the last four weeks, up 233% on the four before (3). 0 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 1 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 7 | 0 | 0 | | 7 Sep 2026 | 2 | 0 | 0 | | 14 Sep 2026 | 2 | 1 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 1 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 10 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## OpenPanel technologies - [OpenPanel](https://junglewise.ai/threats/technologies/openpanel): 26 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "OpenPanel vulnerabilities", https://junglewise.ai/threats/vendors/openpanel, 10 November 2026.