Product by Opf

    Openproject

    55 known vulnerabilities in Openproject (Opf), 0 of them actively exploited (CISA KEV).

    Key figures

    55

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    11

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Openproject (Opf)
    CriticalCVE-2026-46386

    Opf Openproject: Deserialization of Untrusted Data

    		9.9
    CriticalCVE-2026-52782

    Opf Openproject: Authorization Bypass Through User-Controlled Key

    		9.9
    CriticalCVE-2026-25763

    Command Injection on OpenProject repositories leads to Remote Code Execution

    also in 1 other product

    		9.9
    HighCVE-2023-33960

    OpenProject vulnerable to project identifier information leakage through robots.txt

    also in 1 other product

    		7.5
    CriticalCVE-2026-52785

    OpenProject: SQL injection in timestamps functionality

    		9.9
    CriticalCVE-2026-52780

    OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)

    		9.6
    HighCVE-2026-67527

    Opf Openproject: Missing Authorization

    		7.6
    CriticalCVE-2026-24685

    OpenProject has Argument Injection on Repository module that allows Arbitrary File Write

    also in 1 other product

    		8.8
    CriticalCVE-2026-34717

    OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string

    also in 1 other product

    		9.9
    HighCVE-2021-43830

    SQL injection in OpenProject

    also in 1 other product

    		7.4
    HighCVE-2026-52784

    OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"

    		8.8
    HighCVE-2026-22601

    OpenProject is Vulnerable to Code Execution in E-Mail function

    also in 1 other product

    		7.2
    CriticalCVE-2026-32698

    OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution

    also in 1 other product

    		9.1
    CriticalCVE-2026-22600

    OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder

    also in 1 other product

    		9.1
    HighCVE-2026-47193

    OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks

    		7.5
    CriticalCVE-2026-32703

    Opf Openproject: Cross-site Scripting

    also in 1 other product

    		9.1
    HighCVE-2026-52783

    Opf Openproject: Cleartext Storage in a File or on Disk

    		8.2
    MediumCVE-2026-44735

    OpenProject: Shares API Information Disclosure

    		6.5
    MediumCVE-2026-55095

    OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields

    		—
    HighCVE-2026-23625

    OpenProject has stored XSS regression using attachments and script-src self

    also in 1 other product

    		8.7
    MediumCVE-2026-44736

    Opf Openproject: Authorization Bypass Through User-Controlled Key

    		6.5
    CriticalCVE-2026-24772

    OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server

    also in 1 other product

    		8.9
    MediumCVE-2026-44734

    Opf Openproject: Missing Authorization

    		6.5
    HighCVE-2026-33667

    OpenProject: 2FA OTP Verification Missing Rate Limiting

    also in 1 other product

    		7.4
    MediumCVE-2026-24777

    Opf Openproject: Missing Authorization

    also in 1 other product

    		6.7

    All vulnerabilities in search

    All products by Opf