OP
Product
Openproject
37
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 3High 12Medium 20Low 2
Watch
Add Openproject to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-25763 | 9.9 | Feb 6 | OpenProject is an open-source, web-based project management software Affected: before 16.6.7; 17.0.0 before 17.0.3 |
| CVE-2026-22600 | 9.1 | Jan 10 | OpenProject is an open-source, web-based project management software Affected: before 16.6.4 |
| CVE-2026-24772 | 9.0 | Jan 28 | OpenProject is an open-source, web-based project management software Affected: 17.0.0 before 17.0.2 |
| CVE-2026-24685 | 8.8 | Jan 28 | OpenProject is an open-source, web-based project management software Affected: before 16.6.6; 17.0.0 before 17.0.2 |
| CVE-2021-43830 | 8.8 | Dec 14 | OpenProject is a web-based project management software Affected: 12.0.0 before 12.0.4 |
| CVE-2026-34717 | 8.1 | Apr 2 | OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string Affected: before 17.2.3 |
| CVE-2019-11600 | 8.1 | May 13 | A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter Affected: 5.0.0 before 8.3.2 |
| CVE-2017-11667 | 8.1 | Jul 26 | OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session Affected: through 6.1.5; 7.0.0; 7.0.1; 7.0.2 |
| CVE-2023-33960 | 7.5 | Jun 1 | OpenProject is web-based project management software Affected: before 12.5.6 |
| CVE-2026-33667 | 7.4 | Apr 15 | OpenProject: 2FA OTP Verification Missing Rate Limiting Affected: before 17.3.0 |
| CVE-2026-24775 | 7.3 | Jan 28 | OpenProject is an open-source, web-based project management software Affected: 17.0.0 before 17.0.2 |
| CVE-2026-32698 | 7.2 | Mar 18 | OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution Affected: before 16.6.9; 17.0.0 before 17.0.6; 17.1.0 before 17.1.3; 17.2.0 |
| CVE-2026-22601 | 7.2 | Jan 10 | OpenProject is an open-source, web-based project management software Affected: before 16.6.2 |
| CVE-2026-40896 | 7.1 | Apr 20 | OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup Affected: before 17.3.0 |
| CVE-2026-30239 | 7.1 | Mar 11 | OpenProject is an open-source, web-based project management software Affected: before 17.2.0 |
| CVE-2026-24777 | 6.7 | Feb 9 | OpenProject is an open-source, web-based project management software Affected: before 17.0.2 |
| CVE-2026-30235 | 6.5 | Mar 11 | OpenProject is an open-source, web-based project management software Affected: before 17.2.0 |
| CVE-2026-30234 | 6.5 | Mar 11 | OpenProject is an open-source, web-based project management software Affected: before 17.2.0 |
| CVE-2026-23646 | 6.5 | Jan 19 | OpenProject is an open-source, web-based project management software Affected: before 16.6.5; 17.0.0 |
| CVE-2026-22603 | 6.5 | Jan 10 | OpenProject is an open-source, web-based project management software Affected: before 16.6.2 |
| CVE-2023-31140 | 6.5 | May 8 | OpenProject is open source project management software Affected: 7.4.0 before 12.5.4 |
| CVE-2021-32763 | 6.5 | Jul 20 | OpenProject is open-source, web-based project management software Affected: before 11.3.3 |
| CVE-2024-41801 | 6.1 | Jul 25 | OpenProject is open source project management software Affected: before 14.3.0 |
| CVE-2019-17092 | 6.1 | Oct 9 | An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter… Affected: before 9.0.4; 10.0.0 before 10.0.2 |
| CVE-2026-32703 | 5.4 | Mar 18 | OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy Affected: before 16.6.9; 17.0.0 before 17.0.6; 17.1.0 before 17.1.3; 17.2.0 |
| CVE-2026-23625 | 5.4 | Jan 19 | OpenProject is an open-source, web-based project management software Affected: after 16.3.0 before 16.6.5 |
| CVE-2025-24892 | 5.4 | Feb 10 | OpenProject is open-source, web-based project management software Affected: before 15.2.1 |
| CVE-2024-35224 | 5.4 | May 23 | OpenProject is the leading open source project management software Affected: before 13.4.2; 14.0.0 before 14.0.2; 14.1.0 |
| CVE-2026-27723 | 5.3 | Mar 5 | OpenProject is an open-source, web-based project management software Affected: before 17.0.5; 17.1.0 before 17.1.2 |
| CVE-2026-22604 | 5.3 | Jan 10 | OpenProject is an open-source, web-based project management software Affected: 11.2.1 before 16.6.2 |
| CVE-2026-31974 | 4.3 | Mar 11 | OpenProject is an open-source, web-based project management software Affected: before 17.2.0 |
| CVE-2026-30236 | 4.3 | Mar 11 | OpenProject is an open-source, web-based project management software Affected: before 17.2.0 |
| CVE-2026-24776 | 4.3 | Feb 6 | OpenProject is an open-source, web-based project management software Affected: before 17.0.2 |
| CVE-2026-23721 | 4.3 | Jan 19 | OpenProject is an open-source, web-based project management software Affected: before 16.6.5; 17.0.0 |
| CVE-2026-22605 | 4.3 | Jan 10 | OpenProject is an open-source, web-based project management software Affected: before 16.6.3 |
| CVE-2026-25764 | 3.5 | Feb 6 | OpenProject is an open-source, web-based project management software Affected: before 16.6.7; 17.0.0 before 17.0.3 |
| CVE-2026-22602 | 3.5 | Jan 10 | OpenProject is an open-source, web-based project management software Affected: before 16.6.2 |
Showing 37