Opf Openproject
51 CVEs affecting Opf Openproject. Latest disclosed: 2026-06-26. Critical: 9, High: 11.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-52785 | Critical | 9.9 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a SQL injection in timestamps functionality. OpenProjec… |
CVE-2026-52782 | Critical | 9.9 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is an IDOR through /projects/<A>/settings/project_storages… |
CVE-2026-46386 | Critical | 9.9 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to , the official openproject/openproject Docker image ships ENV SECRET_KEY_BASE=OVERW… |
CVE-2026-34717 | Critical | 9.9 | 2026-04-02 | OpenProject is an open-source, web-based project management software. Prior to version 17.2.3, the =n operator in modules/reporting/lib/report/operator.rb:177… |
CVE-2026-25763 | Critical | 9.9 | 2026-02-06 | OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an arbitrary file write vulnerability exists in Open… |
CVE-2026-52780 | Critical | 9.6 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, cache store poisoning leads to Remote Code Execution (RCE). This… |
CVE-2026-32698 | Critical | 9.1 | 2026-03-18 | OpenProject is an open-source, web-based project management software. Versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1 are vulnerable to an SQL injection a… |
CVE-2026-22600 | Critical | 9.1 | 2026-01-10 | OpenProject is an open-source, web-based project management software. A Local File Read (LFR) vulnerability exists in the work package PDF export functionality… |
CVE-2026-32703 | Critical | 9.0 | 2026-03-18 | OpenProject is an open-source, web-based project management software. In versions prior to 16.6.9, 17.0.6, 17.1.3, and 17.2.1, the Repositories module did not… |
CVE-2026-24772 | High | 8.9 | 2026-01-28 | OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchro… |
CVE-2026-52784 | High | 8.8 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, there is a CSRF on TARGET through /users/:id via POST parameter… |
CVE-2026-24685 | High | 8.8 | 2026-01-28 | OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitrary file write vulnerability in OpenPro… |
CVE-2026-23625 | High | 8.7 | 2026-01-19 | OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerabilit… |
CVE-2026-52783 | High | 8.2 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, OpenProject's Storages module writes the OneDrive/SharePoint use… |
CVE-2024-35224 | High | 7.6 | 2024-05-23 | OpenProject is the leading open source project management software. OpenProject utilizes `tablesorter` inside of the Cost Report feature. This dependency, when… |
CVE-2026-47193 | High | 7.5 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field valu… |
CVE-2023-33960 | High | 7.5 | 2023-06-01 | OpenProject is web-based project management software. For any OpenProject installation, a `robots.txt` file is generated through the server to denote which rou… |
CVE-2026-33667 | High | 7.4 | 2026-04-15 | OpenProject is an open-source project management application. In versions prior to 17.3.0, 2FA OTP verification in the confirm_otp action of the two_factor_aut… |
CVE-2021-43830 | High | 7.4 | 2021-12-14 | OpenProject is a web-based project management software. OpenProject versions >= 12.0.0 are vulnerable to a SQL injection in the budgets module. For authenticat… |
CVE-2026-22601 | High | 7.2 | 2026-01-10 | OpenProject is an open-source, web-based project management software. For OpenProject version 16.6.1 and below, a registered administrator can execute arbitrar… |