Login Request a demo
OP
Vendor
opf
1 product with CVEs on record
42
CVEs
0
On KEV
0
New 30D
Products
OP
openproject
opf
9.9
42 CVEs0 on KEV0 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-55095
OP
openproject
opf
5.3
0%
Aug 20OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields
CVE-2026-67529
OP
openproject
opf
4.3
0%
Jul 30OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)
CVE-2026-67528
OP
openproject
opf
4.3
0%
Jul 30OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure
CVE-2026-67527
OP
openproject
opf
7.6
0%
Jul 30OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"
CVE-2026-44733
OP
openproject
opf
5.9
0%
Jun 26OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements
CVE-2026-44731
OP
openproject
opf
4.3
0%
Jun 26OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure
CVE-2026-44732
OP
openproject
opf
4.3
0%
Jun 26OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources
CVE-2026-44734
OP
openproject
opf
6.5
0%
Jun 26OpenProject: Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_reports/[REPORT_ID]/rename
CVE-2026-44735
OP
openproject
opf
6.5
0%
Jun 26OpenProject: Shares API Information Disclosure
CVE-2026-44696
OP
openproject
opf
5.7
0%
Jun 26OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltration
CVE-2026-49355
OP
openproject
opf
4.3
0%
Jun 26OpenProject: Private work package data disclosure through single meeting agenda item API
CVE-2026-44736
OP
openproject
opf
6.5
0%
Jun 26OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects
CVE-2026-46386
OP
openproject
opf
9.9
0%
Jun 26OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`
CVE-2026-52780
OP
openproject
opf
9.6
0%
Jun 26OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)
CVE-2026-52779
OP
openproject
opf
5.4
0%
Jun 26OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from unauthorized projects
CVE-2026-47193
OP
openproject
opf
7.5
0%
Jun 26OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks
CVE-2026-52781
OP
openproject
opf
6.4
0%
Jun 26OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"
CVE-2026-52782
OP
openproject
opf
9.9
0%
Jun 26OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resources
CVE-2026-52783
OP
openproject
opf
8.2
0%
Jun 26OpenProject: Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.<id>.httpx_access_token" leads to Sensitive Data Exposure
CVE-2026-52784
OP
openproject
opf
8.8
0%
Jun 26OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"
CVE-2026-52785
OP
openproject
opf
9.9
0%
Jun 26OpenProject: SQL injection in timestamps functionality
CVE-2026-40896
OP
openproject
opf
7.1
0%
Apr 20OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup
CVE-2026-33667
OP
openproject
opf
7.4
0%
Apr 15OpenProject: 2FA OTP Verification Missing Rate Limiting
CVE-2026-34717
OP
openproject
opf
8.1
0%
Apr 2OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string
CVE-2026-32703
OP
openproject
opf
5.4
0%
Mar 18OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policy
CVE-2026-32698
OP
openproject
opf
7.2
0%
Mar 18OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution
CVE-2026-31974
OP
openproject
opf
4.3
0%
Mar 11Blind SSRF on OpenProject instance via webhooks
CVE-2026-30239
OP
openproject
opf
7.1
0%
Mar 11OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgets
CVE-2026-30236
OP
openproject
opf
4.3
0%
Mar 11OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rate
CVE-2026-30235
OP
openproject
opf
6.5
0%
Mar 11Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering
CVE-2026-30234
OP
openproject
opf
6.5
0%
Mar 11OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR)
CVE-2026-27723
OP
openproject
opf
5.3
0%
Mar 5OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projects
CVE-2026-24777
OP
openproject
opf
6.7
0%
Feb 9OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts
CVE-2026-25763
OP
openproject
opf
9.9
1%
Feb 6Command Injection on OpenProject repositories leads to Remote Code Execution
CVE-2026-25764
OP
openproject
opf
3.5
0%
Feb 6OpenProject vulnerable to Stored HTML injection
CVE-2026-24776
OP
openproject
opf
4.3
0%
Feb 6OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer
CVE-2026-24775
OP
openproject
opf
7.3
0%
Jan 28OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension
CVE-2026-24772
OP
openproject
opf
9.0
0%
Jan 28OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server
CVE-2026-24685
OP
openproject
opf
8.8
0%
Jan 28OpenProject has Argument Injection on Repository module that allows Arbitrary File Write
CVE-2026-23721
OP
openproject
opf
4.3
0%
Jan 19OpenProject users with "View Members" permission in any project can view all Group memberships
CVE-2026-23646
OP
openproject
opf
6.5
0%
Jan 19OpenProject users can delete other user's session, causing them to be logged out
CVE-2026-23625
OP
openproject
opf
5.4
0%
Jan 19OpenProject has stored XSS regression using attachments and script-src self