OP
Vendor
Openproject
37
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-40896 | OP Openproject Openproject | 7.1 | Apr 20 | OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup |
| CVE-2026-33667 | OP Openproject Openproject | 7.4 | Apr 15 | OpenProject: 2FA OTP Verification Missing Rate Limiting |
| CVE-2026-34717 | OP Openproject Openproject | 8.1 | Apr 2 | OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string |
| CVE-2026-32703 | OP Openproject Openproject | 5.4 | Mar 18 | OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy |
| CVE-2026-32698 | OP Openproject Openproject | 7.2 | Mar 18 | OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution |
| CVE-2026-31974 | OP Openproject Openproject | 4.3 | Mar 11 | Blind SSRF on OpenProject instance via webhooks |
| CVE-2026-30239 | OP Openproject Openproject | 7.1 | Mar 11 | OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets |
| CVE-2026-30236 | OP Openproject Openproject | 4.3 | Mar 11 | OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate |
| CVE-2026-30235 | OP Openproject Openproject | 6.5 | Mar 11 | Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering |
| CVE-2026-30234 | OP Openproject Openproject | 6.5 | Mar 11 | OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR) |
| CVE-2026-27723 | OP Openproject Openproject | 5.3 | Mar 5 | OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projects |
| CVE-2026-24777 | OP Openproject Openproject | 6.7 | Feb 9 | OpenProject is an open-source, web-based project management software |
| CVE-2026-25764 | OP Openproject Openproject | 3.5 | Feb 6 | OpenProject is an open-source, web-based project management software |
| CVE-2026-25763 | OP Openproject Openproject | 9.9 | Feb 6 | OpenProject is an open-source, web-based project management software |
| CVE-2026-24776 | OP Openproject Openproject | 4.3 | Feb 6 | OpenProject is an open-source, web-based project management software |
| CVE-2026-24775 | OP Openproject Openproject | 7.3 | Jan 28 | OpenProject is an open-source, web-based project management software |
| CVE-2026-24772 | OP Openproject Openproject | 9.0 | Jan 28 | OpenProject is an open-source, web-based project management software |
| CVE-2026-24685 | OP Openproject Openproject | 8.8 | Jan 28 | OpenProject is an open-source, web-based project management software |
| CVE-2026-23721 | OP Openproject Openproject | 4.3 | Jan 19 | OpenProject is an open-source, web-based project management software |
| CVE-2026-23646 | OP Openproject Openproject | 6.5 | Jan 19 | OpenProject is an open-source, web-based project management software |
| CVE-2026-23625 | OP Openproject Openproject | 5.4 | Jan 19 | OpenProject is an open-source, web-based project management software |
| CVE-2026-22605 | OP Openproject Openproject | 4.3 | Jan 10 | OpenProject is an open-source, web-based project management software |
| CVE-2026-22604 | OP Openproject Openproject | 5.3 | Jan 10 | OpenProject is an open-source, web-based project management software |
| CVE-2026-22603 | OP Openproject Openproject | 6.5 | Jan 10 | OpenProject is an open-source, web-based project management software |
| CVE-2026-22602 | OP Openproject Openproject | 3.5 | Jan 10 | OpenProject is an open-source, web-based project management software |
| CVE-2026-22601 | OP Openproject Openproject | 7.2 | Jan 10 | OpenProject is an open-source, web-based project management software |
| CVE-2026-22600 | OP Openproject Openproject | 9.1 | Jan 10 | OpenProject is an open-source, web-based project management software |
| CVE-2025-24892 | OP Openproject Openproject | 5.4 | Feb 10 | OpenProject is open-source, web-based project management software |
| CVE-2024-41801 | OP Openproject Openproject | 6.1 | Jul 25 | OpenProject is open source project management software |
| CVE-2024-35224 | OP Openproject Openproject | 5.4 | May 23 | OpenProject is the leading open source project management software |
| CVE-2023-33960 | OP Openproject Openproject | 7.5 | Jun 1 | OpenProject is web-based project management software |
| CVE-2023-31140 | OP Openproject Openproject | 6.5 | May 8 | OpenProject is open source project management software |
| CVE-2021-43830 | OP Openproject Openproject | 8.8 | Dec 14 | OpenProject is a web-based project management software |
| CVE-2021-32763 | OP Openproject Openproject | 6.5 | Jul 20 | OpenProject is open-source, web-based project management software |
| CVE-2019-17092 | OP Openproject Openproject | 6.1 | Oct 9 | An XSS vulnerability in project list in OpenProject before 9.0.4 and 10.x before 10.0.2 allows remote attackers to inject arbitrary web script or HTML via the sortBy parameter… |
| CVE-2019-11600 | OP Openproject Openproject | 8.1 | May 13 | A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter |
| CVE-2017-11667 | OP Openproject Openproject | 8.1 | Jul 26 | OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perform APIv3 requests indefinitely by leveraging a hijacked session |