CVE-2026-85609: Server-Side Request Forgery (SSRF)

Openpanel before 2.3.0 contains an unauthenticated full-read server-side request forgery SSRF vulnerability in the GET /tools/site-checker endpoint apps/api/src/controllers/tools.controller.ts. The endpoint passes a user-supplied url query parameter to fetchWithRedirects and performs server-side...

CVE-2026-77769 OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries

The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardIddashboardId. The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied...

CVE-2026-77769 OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries

The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardIddashboardId. The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied...

CVE-2026-77769 OpenPanel report.list Queries Reports by an Unverified dashboardId, Crossing Organization Boundaries

The report.list procedure in packages/trpc/src/routers/report.ts accepted a projectId and a dashboardId and returned getReportsByDashboardIddashboardId. The enforceAccess middleware in packages/trpc/src/trpc.ts verified membership for the supplied projectId, but nothing verified that the supplied...

CVE-2026-77769

OpenPanel 's report.list tRPC procedure contained a cross-organization authorization bypass . The enforceAccess middleware verified membership for the supplied projectId, but the dashboardId parameter was never validated against that project. The underlying getReportsByDashboardId query selected ...

CVE-2026-77768 OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportByIdreportId directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consistin...

CVE-2026-77768 OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportByIdreportId directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consistin...

CVE-2026-77768

CVE-2026-77768 is an authorization bypass in OpenPanel , an open-source analytics platform. The report.get tRPC procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned the report directly via getReportById(), which performs a findUnique with no project scoping. The ...

CVE-2026-77768 OpenPanel report.get Returns Any Report by Identifier Without Checking Project Access

The report.get procedure in packages/trpc/src/routers/report.ts accepted only a reportId and returned getReportByIdreportId directly. The enforceAccess middleware in packages/trpc/src/trpc.ts evaluates membership only when the input carries a projectId or organizationId key, so an input consistin...

EUVD-2024-52000

Malicious code in bioql PyPI...

EUVD-2024-51999

Malicious code in bioql PyPI...

EUVD-2024-51988

Malicious code in bioql PyPI...

CVE-2024-53582

An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to execute a directory traversal via a crafted HTTP request...

CVE-2024-53584

OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter...

CVE-2024-53537

An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manager...

OpenPanel 0.3.4 - OS Command Injection

Exploit Title: OpenPanel 0.3.4 - OS Command Injection Date: Nov 25, 2024 Exploit Author: Korn Chaisuwan, Punthat Siriwan, Pongtorn Angsuchotmetee Vendor Homepage: https://openpanel.com/ Software Link: https://openpanel.com/ Version: 0.3.4 Tested on: macOS CVE : CVE-2024-53584 POST /server/timezon...

OpenPanel Copy and View functions in the File Manager 0.3.4 - Directory Traversal

Exploit Title: OpenPanel Copy and View functions in the File Manager 0.3.4 - Directory Traversal Date: Nov 25, 2024 Exploit Author: Korn Chaisuwan, Punthat Siriwan, Pongtorn Angsuchotmetee Vendor Homepage: https://openpanel.com/ Software Link: https://openpanel.com/ Version: 0.3.4 Tested on: macO...

OpenPanel 0.3.4 - Directory Traversal

Exploit Title: OpenPanel 0.3.4 - Directory Traversal Date: Dec 05, 2024 Exploit Author: Korn Chaisuwan, Punthat Siriwan, Pongtorn Angsuchotmetee Vendor Homepage: https://openpanel.com/ Software Link: https://openpanel.com/ Version: 0.3.4 Tested on: macOS CVE : CVE-2024-53537 Compress Function POS...

OpenPanel 0.3.4 - Incorrect Access Control

Exploit Title: OpenPanel 0.3.4 - Incorrect Access Control Date: Nov 25, 2024 Exploit Author: Korn Chaisuwan, Punthat Siriwan, Pongtorn Angsuchotmetee Vendor Homepage: https://openpanel.com/ Software Link: https://openpanel.com/ Version: 0.3.4 Tested on: macOS CVE : CVE-2024-53582 GET /files/../...

OpenPanel 0.3.4 Directory Traversal / Arbitrary File Read

OpenPanel version 0.3.4 suffers from a directory traversal vulnerability in the fix permission functionality. This can be leveraged to change permissions on files unaccessible to userland and make them accessible to attackers. Exploit Title: OpenPanel 0.3.4 - Insecure Permission Modification via...