OP
Product
Openproject
37
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 3High 12Medium 20Low 2
Watch
Add Openproject to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-24685 | 8.8 | Jan 28 | OpenProject is an open-source, web-based project management software Affected: before 16.6.6; 17.0.0 before 17.0.2 |
| CVE-2021-43830 | 8.8 | Dec 14 | OpenProject is a web-based project management software Affected: 12.0.0 before 12.0.4 |
| CVE-2026-34717 | 8.1 | Apr 2 | OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string Affected: before 17.2.3 |
| CVE-2019-11600 | 8.1 | May 13 | A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter Affected: 5.0.0 before 8.3.2 |
| CVE-2017-11667 | 8.1 | Jul 26 | OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session Affected: through 6.1.5; 7.0.0; 7.0.1; 7.0.2 |
| CVE-2023-33960 | 7.5 | Jun 1 | OpenProject is web-based project management software Affected: before 12.5.6 |
| CVE-2026-33667 | 7.4 | Apr 15 | OpenProject: 2FA OTP Verification Missing Rate Limiting Affected: before 17.3.0 |
| CVE-2026-24775 | 7.3 | Jan 28 | OpenProject is an open-source, web-based project management software Affected: 17.0.0 before 17.0.2 |
| CVE-2026-32698 | 7.2 | Mar 18 | OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution Affected: before 16.6.9; 17.0.0 before 17.0.6; 17.1.0 before 17.1.3; 17.2.0 |
| CVE-2026-22601 | 7.2 | Jan 10 | OpenProject is an open-source, web-based project management software Affected: before 16.6.2 |
| CVE-2026-40896 | 7.1 | Apr 20 | OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup Affected: before 17.3.0 |
| CVE-2026-30239 | 7.1 | Mar 11 | OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets Affected: before 17.2.0 |
Showing 12