EUVD-2026-110523

OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated project members to break ClickHouse string literals by supplying backslashes in event names. Attackers with read access can submit crafted events.name values to the chart.sankey...

CVE-2026-116815

OpenPanel versions prior to 3.0.0 are vulnerable to an improper escaping vulnerability within the sankey.service.ts component. This flaw allows authenticated project members with read access to submit crafted events[].name values containing backslashes, which break ClickHouse string literals. The...