https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-116819/https://vulnfeed.org/cve/CVE-2026-116819/Tue, 27 Oct 2026 00:17:16 +0000OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to obtain plaintext integration secrets because the notification.rules query skips redactIntegration. Attackers can call the notification.rules tRPC query to retrieve Slack bot tokens, webhook URLs, and authorization headers for use against external systems.https://vulnfeed.org/cve/CVE-2026-116811/https://vulnfeed.org/cve/CVE-2026-116811/Tue, 27 Oct 2026 00:17:14 +0000OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member to bypass the AST allowlist by aliasing the Function constructor. Attackers with write access can read payload.constructor.constructor into a local and call it to run arbitrary code in the worker process.https://vulnfeed.org/cve/CVE-2026-116808/https://vulnfeed.org/cve/CVE-2026-116808/Tue, 27 Oct 2026 00:17:13 +0000OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant data by supplying a crafted property parameter to profile.values. Attackers can inject a SELECT expression with their own FROM/WHERE clauses and comment out the project_id scope to exfiltrate other projects' profiles, events, and sessions.