Известные уязвимости
| CVE | Название | Затронутые версии | CVSS | Эксплуатируется | EPSS | Опубликовано |
|---|---|---|---|---|---|---|
| CVE-2026-55095 | OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields | * | 5.3 | — | 2026-08-21 | |
| CVE-2026-67529 | OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries... | * | 4.3 | — | 2026-07-31 | |
| CVE-2026-67528 | OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data... | * | 4.3 | — | 2026-07-31 | |
| CVE-2026-67527 | OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks" | * | 7.6 | — | 2026-07-31 | |
| CVE-2026-44733 | OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass p... | * | 5.9 | — | 2026-06-27 | |
| CVE-2026-44731 | OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user... | * | 4.3 | — | 2026-06-27 | |
| CVE-2026-44732 | OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unau... | * | 4.3 | — | 2026-06-27 | |
| CVE-2026-44734 | OpenProject: Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_... | * | 6.5 | — | 2026-06-27 | |
| CVE-2026-44735 | OpenProject: Shares API Information Disclosure | * | 6.5 | — | 2026-06-27 | |
| CVE-2026-44696 | OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfil... | * | 5.7 | — | 2026-06-27 | |
| CVE-2026-49355 | OpenProject: Private work package data disclosure through single meeting agenda item API | * | 4.3 | — | 2026-06-27 | |
| CVE-2026-44736 | OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects | * | 6.5 | — | 2026-06-27 | |
| CVE-2026-46386 | OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERW... | * | 9.9 | — | 2026-06-27 | |
| CVE-2026-52780 | OpenProject: Cache store poisoning leads to Remote Code Execution (RCE) | * | 9.6 | — | 2026-06-27 | |
| CVE-2026-52779 | OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from... | * | 5.4 | — | 2026-06-27 | |
| CVE-2026-47193 | OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks | * | 7.5 | — | 2026-06-27 | |
| CVE-2026-52781 | OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST p... | * | 6.4 | — | 2026-06-27 | |
| CVE-2026-52782 | OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_proj... | * | 9.9 | — | 2026-06-27 | |
| CVE-2026-52783 | OpenProject: Information Disclosure (cleartext storage of data) on localhost through memcached via Others "sto... | * | 8.2 | — | 2026-06-27 | |
| CVE-2026-52784 | OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]" | * | 8.8 | — | 2026-06-27 | |
| CVE-2026-52785 | OpenProject: SQL injection in timestamps functionality | * | 9.9 | — | 2026-06-27 | |
| CVE-2026-40896 | OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookup | * | 6.5 | — | 2026-04-21 | |
| CVE-2026-33667 | OpenProject: 2FA OTP Verification Missing Rate Limiting | * | 7.4 | — | 2026-04-16 | |
| CVE-2026-34717 | OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_string | * | 9.9 | — | 2026-04-03 | |
| CVE-2026-32703 | OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Securi... | * | 9.1 | — | 2026-03-19 | |
| CVE-2026-32698 | OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Execution | * | 9.1 | — | 2026-03-19 | |
| CVE-2026-31974 | Blind SSRF on OpenProject instance via webhooks | * | 3.0 | — | 2026-03-12 | |
| CVE-2026-30239 | OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other bu... | * | 6.5 | — | 2026-03-12 | |
| CVE-2026-30236 | OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hou... | * | 4.3 | — | 2026-03-12 | |
| CVE-2026-30235 | Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobbering | * | 6.5 | — | 2026-03-12 | |
| CVE-2026-30234 | OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR) | * | 6.5 | — | 2026-03-12 | |
| CVE-2026-27723 | OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projects | * | 4.3 | — | 2026-03-06 | |
| CVE-2026-24777 | OpenProject has Improper Access Control on User Management allows user managers to lock admin accounts | * | 6.7 | — | 2026-02-10 | |
| CVE-2026-25763 | Command Injection on OpenProject repositories leads to Remote Code Execution | * | 9.4 | — | 2026-02-07 | |
| CVE-2026-25764 | OpenProject vulnerable to Stored HTML injection | * | 3.5 | — | 2026-02-07 | |
| CVE-2026-24776 | OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transfer | * | 4.3 | — | 2026-02-07 | |
| CVE-2026-24775 | OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blockn... | * | 6.3 | — | 2026-01-29 | |
| CVE-2026-24772 | OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Server | * | 8.9 | — | 2026-01-29 | |
| CVE-2026-24685 | OpenProject has Argument Injection on Repository module that allows Arbitrary File Write | * | 9.4 | — | 2026-01-29 | |
| CVE-2026-23721 | OpenProject users with "View Members" permission in any project can view all Group memberships | * | 4.3 | — | 2026-01-20 | |
| CVE-2026-23646 | OpenProject users can delete other user's session, causing them to be logged out | * | 6.5 | — | 2026-01-20 | |
| CVE-2026-23625 | OpenProject has stored XSS regression using attachments and script-src self | * | 8.7 | — | 2026-01-20 | |
| CVE-2026-22605 | OpenProject is Vulnerable to Insecure Direct Object Reference in Meetings | * | 4.3 | — | 2026-01-10 | |
| CVE-2026-22604 | OpenProject is vulnerable to user enumeration via the change password function | * | 6.9 | — | 2026-01-10 | |
| CVE-2026-22603 | OpenProject has no protection against brute-force attacks in the Change Password function | * | 6.9 | — | 2026-01-10 | |
| CVE-2026-22602 | OpenProject is Vulnerable to User Enumeration via User ID | * | 3.5 | — | 2026-01-10 | |
| CVE-2026-22601 | OpenProject is Vulnerable to Code Execution in E-Mail function | * | 8.6 | — | 2026-01-10 | |
| CVE-2026-22600 | OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coder | * | 9.1 | — | 2026-01-10 | |
| CVE-2025-24892 | OpenProject stored HTML injection vulnerability | * | 3.5 | — | 2025-02-11 | |
| CVE-2024-41801 | OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configuration | * | 4.7 | — | 2024-07-26 | |
| CVE-2024-35224 | Stored Cross-Site Scripting (XSS) in OpenProject | * | 7.6 | — | 2024-05-23 | |
| CVE-2023-33960 | OpenProject vulnerable to project identifier information leakage through robots.txt | * | 7.5 | — | 2023-06-02 | |
| CVE-2023-31140 | OpenProject user sessions not terminated after activation of 2FA | * | 4.8 | — | 2023-05-09 | |
| CVE-2021-43830 | SQL injection in OpenProject | * | 7.4 | — | 2021-12-15 | |
| CVE-2021-32763 | Regular Expression Denial of Service in OpenProject forum messages | * | 4.3 | — | 2021-07-21 | |
| CVE-2017-11667 | OpenProject before 6.1.6 and 7.x before 7.0.3 mishandles session expiry, which allows remote attackers to perf... | * | — | — | 2017-07-27 |
Отслеживайте эти версии на своих серверах
InfraGuard собирает версии установленного ПО со всех серверов и отмечает версии с известными уязвимостями. Self-hosted — данные не покидают вашу сеть.
Данные: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (об EPSS см. https://www.first.org/epss), endoflife.date. Список ПО: awesome-selfhosted (CC BY-SA 3.0).