Veille CVE

Semaine du 14 septembre au 20 septembre 2026

4 CVE

Critique 1 Élevée 0 Moyenne 2 Faible 1 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « Openpanel-dev openpanel » ✕
  1. CVE-2026-93985 9.9 Critique

    Openpanel-dev openpanel

    OpenPanel js-runtime through 2.3.0 contains a sandbox escape vulnerability in the JavaScript webhook template validator that fails to block computed member access to constructor chains. Attackers with project write access can create webhook templates using computed property notation to access Function constructor and execute arbitrary code in the worker process.

  2. CVE-2026-93984 5.3 Moyenne

    Openpanel-dev openpanel

    OpenPanel tracking API through 2.3.0 fails to verify client secret cryptographic hash before authorizing revenue events and bot filtering. Attackers with only a public client ID can supply arbitrary dummy secrets to inject forged revenue metrics and bypass bot detection filters.

  3. CVE-2026-93983 5.0 Moyenne

    Openpanel-dev openpanel

    OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects.

  4. CVE-2026-93982 3.3 Faible

    Openpanel-dev openpanel

    OpenPanel through 2.3.0 writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture base64-encoded credentials to replay MCP requests and access project analytics.