CVE-2026-116808: OpenPanel
- Severity
- 8.6 (HIGH)
- Vendor
- OPENPANEL BEFORE
- Affected versions
- Before 3.0.0
- Fixed version
- 3.0.0
- Patch status
- Patched
- Published
- 2026-10-27T00:17:13.347
- Modified
- 2026-10-27T00:17:13.590
Why it matters
High-severity vulnerability requiring prioritized review.
Recommended admin actions
- Review and patch based on exposure, asset criticality, and business impact.
- Compare installed versions against the affected version range in the advisory.
- Review logs for suspicious activity related to the affected application or component.
Technical summary
OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id scope to exfiltrate other projects' profiles, events, and sessions.
View the official NVD record for CVE-2026-116808
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
774 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-115905 |
zip is a zip library for Rust that supports reading and writing simple ZIP files PATCH
Reporter: SECURITY-ADVISORIES
|
10
CRITICAL
|
VIEW RECORD |
| CVE-2026-115188 |
mautic/core
Reporter: SECURITY
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-102649 |
Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator PATCH
Reporter: SECURITY-ADVISORIES
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-110720 |
Consul-k8s PATCH
Reporter: SECURITY
|
9.9
CRITICAL
|
VIEW RECORD |
| CVE-2026-107092 |
NexoPOS v6.2.4
Reporter: CVE
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-107656 |
FortiSandbox
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-65184 |
Avocent ACS8000
Reporter: 44488DAB-36DB-4358-99F9-BC116477F914
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-10757 |
There is a SQL injection vulnerability in Esri ArcGIS Server
Reporter: PSIRT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-110475 |
CreditNirvana Collections Platform (CollectionWorkz)
Reporter: VDISCLOSE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-116214 |
MacCMS v10 PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-116485 |
danmu api PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-59106 |
Cynap Pure (Next Gen), Cynap Bridge
Reporter: A6D3DC9E-0591-4A13-BCE7-0F5B31FF6158
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-77055 |
black_debian_images PATCH
Reporter: CVD
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-93328 |
MCP Toolbox for Databases (googleapis/mcp-toolbox)
Reporter: F45CBF4E-4146-4068-B7E1-655FFC2C548C
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-112346 |
OpenHands Software Agent SDK PATCH
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-116508 |
A950RG
Reporter: CNA
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-59107 |
Cynap Pro, Cynap Core Pro
Reporter: A6D3DC9E-0591-4A13-BCE7-0F5B31FF6158
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-116747 |
Kener 3.0.0 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-115693 |
hackney PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
9.1
CRITICAL
|
VIEW RECORD |
| CVE-2026-111841 |
Aman FunnelKit Automations wp-marketing-automations
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-82944 |
SOEM
Reporter: A6D3DC9E-0591-4A13-BCE7-0F5B31FF6158
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-115189 |
execution of arbitrary code on the server with the privileges of the web server process
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-77059 |
boneIO Black PATCH
Reporter: CVD
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-115748 |
**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-105608 |
HASHICORP PATCH
Reporter: SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112438 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112623 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112626 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112637 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112651 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112655 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112659 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-112688 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-113947 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-64759 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-86929 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-116818 |
OpenPanel PATCH
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2024-58400 |
llama.cpp
Reporter: DISCLOSURE
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-116836 |
airMAX M
Reporter: FE490CE8-0395-4072-90D8-2707E1BDF984
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-116837 |
airMAX M
Reporter: FE490CE8-0395-4072-90D8-2707E1BDF984
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-116838 |
airMAX M
Reporter: FE490CE8-0395-4072-90D8-2707E1BDF984
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-108525 |
the HTTP/2 implementation of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-108529 |
Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-109584 |
the HTTP/2 implementation of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-110474 |
Agentic AI Call Centre
Reporter: VDISCLOSE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-110499 |
the HTTP/2 implementation of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-111101 |
the HTTP/1.1 chunked body reader of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-113436 |
Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-114213 |
the WebSocket fragment reassembly of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-115269 |
the HTTP/2 request body reader of mtrudel bandit PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-77052 |
boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path PATCH
Reporter: CVD
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-77053 |
the first-run wizard, and every API route is restricted to an authenticated role PATCH
Reporter: CVD
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116543 |
Open5GS 1.3.0
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116588 |
dd-trace-py PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116591 |
compress provides various compression algorithms PATCH
Reporter: SECURITY-ADVISORIES
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116738 |
VMime
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116748 |
Transmission 4.0.0 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116811 |
OpenPanel PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116843 |
Mistral Vibe PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-116231 |
Pugongying X5 Pro
Reporter: CNA
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-116232 |
Pugongying X5 Pro
Reporter: CNA
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-116219 |
Dolibarr ERP CRM PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-112345 |
TTLock
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-112343 |
Syncplify Server! PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-115924 |
Rembg is a tool to remove images background PATCH
Reporter: SECURITY-ADVISORIES
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-116504 |
A950RG
Reporter: CNA
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-116506 |
A950RG
Reporter: CNA
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-116808 |
OpenPanel PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-113345 |
Electronic delivery item Inspection Support System
Reporter: VULTURES
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116233 |
Pugongying X5 Pro
Reporter: CNA
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116234 |
Pugongying X5 Pro
Reporter: CNA
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116235 |
Pugongying X5 Pro
Reporter: CNA
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116237 |
Pugongying X5 Pro
Reporter: CNA
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-115608 |
an SQL Command ('SQL Injection') vulnerability in Crocoblock JetEngine jet-engine
Reporter: AUDIT
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-115948 |
David Lingren Media LIbrary Assistant media-library-assistant
Reporter: AUDIT
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-71456 |
Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass PATCH
Reporter: PRODUCTSECURITY
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116505 |
A950RG
Reporter: CNA
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116723 |
FLTK
Reporter: DISCLOSURE
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116724 |
FLTK
Reporter: DISCLOSURE
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116816 |
llama.cpp
Reporter: DISCLOSURE
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-116116 |
GM8135S Camera
Reporter: CNA
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-107894 |
V-SFT
Reporter: VULTURES
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-107895 |
V-SFT
Reporter: VULTURES
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-107896 |
V-SFT
Reporter: VULTURES
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-107897 |
V-SFT
Reporter: VULTURES
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-107898 |
V-SFT
Reporter: VULTURES
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-107899 |
V-SFT
Reporter: VULTURES
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-107900 |
V-SFT
Reporter: VULTURES
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-65327 |
APPLE PATCH
Reporter: PRODUCT-SECURITY
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-116819 |
OpenPanel PATCH
Reporter: DISCLOSURE
|
8.4
HIGH
|
VIEW RECORD |
| CVE-2026-70388 |
SOEM
Reporter: A6D3DC9E-0591-4A13-BCE7-0F5B31FF6158
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-116741 |
Speex (libspeex)
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-116825 |
YesWiki from 4.6.2 PATCH
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-111103 |
Product identification pending PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-115193 |
MAUTIC
Reporter: SECURITY
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-97200 |
hackney conn in benoitc hackney PATCH
Reporter: 6B3AD84C-E1A6-4BF7-A703-F496B71E49DB
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-116539 |
Netty netty-tcnative PATCH
Reporter: DISCLOSURE
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-116540 |
netty-tcnative 2.0.66.Final PATCH
Reporter: DISCLOSURE
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-116541 |
Netty netty-tcnative PATCH
Reporter: DISCLOSURE
|
8.2
HIGH
|
VIEW RECORD |
| CVE-2026-116634 |
OmniRoute 3.8.50 PATCH
Reporter: DISCLOSURE
|
8.2
HIGH
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.