CVE-2026-116818

OpenPanel versions prior to 3.0.0 are vulnerable to an unauthenticated ClickHouse SQL injection vulnerability. The root cause is a lack of session and project-access checks on the /live/visitors/:projectId WebSocket. Remote attackers can inject SQL via the projectId parameter, using techniques li...

CVE-2026-116812

OpenPanel versions before 3.0.0 are vulnerable to a SQL injection flaw within the profileColumnAccess function in cohort.service.ts. This issue occurs because the application fails to escape profile filter column names . Project-read members can exploit this by submitting a cohort.preview filter ...