Login Request a demo
OP
Product
openproject
by opf · last CVE Aug 20, 2026
48
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities48In the news0Timeline
Severity mix
Critical 7High 12Medium 27Low 2
Severity
All severities48Critical7High12Medium27Low2
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add openproject to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-46386
9.9
0%
Jun 26
OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`
Affected: >= 8.3.0, < 17.2.4; >= 17.3.0, < 17.3.2
CVE-2026-52782
9.9
0%
Jun 26
OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources
Affected: < 17.3.3; >= 17.4.0, < 17.4.1
CVE-2026-52785
9.9
0%
Jun 26
OpenProject: SQL injection in timestamps functionality
Affected: < 17.3.3; >= 17.4.0, < 17.4.1
CVE-2026-25763
9.9
1%
Feb 6
Command Injection on OpenProject repositories leads to Remote Code Execution
Affected: < 16.6.7; < 17.0.3
CVE-2026-52780
9.6
0%
Jun 26
OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)
Affected: < 17.3.3; >= 17.4.0, < 17.4.1
CVE-2026-22600
9.1
0%
Jan 10
OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder
Affected: < 16.6.4
CVE-2026-24772
9.0
0%
Jan 28
OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server
Affected: OpenProject >= 17.0.0, < 17.0.2; openproject/hocuspocus < 17.0.2
Showing 7