agentprime: opf-openprojectEvery new CVE for opf-openproject.https://agentprime.io/CVE-2026-55095: OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fieldshttps://agentprime.io/advisories/CVE-2026-55095/https://agentprime.io/advisories/CVE-2026-55095/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 20 Aug 2026 16:26:01 GMTCVECVE-2026-67529: OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)https://agentprime.io/advisories/CVE-2026-67529/https://agentprime.io/advisories/CVE-2026-67529/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 30 Jul 2026 19:29:24 GMTCVECVE-2026-67528: OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposurehttps://agentprime.io/advisories/CVE-2026-67528/https://agentprime.io/advisories/CVE-2026-67528/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 30 Jul 2026 19:24:09 GMTCVECVE-2026-67527: OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"https://agentprime.io/advisories/CVE-2026-67527/https://agentprime.io/advisories/CVE-2026-67527/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Thu, 30 Jul 2026 19:19:25 GMTCVECVE-2026-44733: OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirementshttps://agentprime.io/advisories/CVE-2026-44733/https://agentprime.io/advisories/CVE-2026-44733/CVSS 5.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 19:47:13 GMTCVECVE-2026-44731: OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosurehttps://agentprime.io/advisories/CVE-2026-44731/https://agentprime.io/advisories/CVE-2026-44731/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 19:41:53 GMTCVECVE-2026-44732: OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resourceshttps://agentprime.io/advisories/CVE-2026-44732/https://agentprime.io/advisories/CVE-2026-44732/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 19:39:58 GMTCVECVE-2026-44734: OpenProject: Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_reports/[REPORT_ID]/renamehttps://agentprime.io/advisories/CVE-2026-44734/https://agentprime.io/advisories/CVE-2026-44734/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 19:33:08 GMTCVECVE-2026-44735: OpenProject: Shares API Information Disclosurehttps://agentprime.io/advisories/CVE-2026-44735/https://agentprime.io/advisories/CVE-2026-44735/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 19:32:21 GMTCVECVE-2026-44696: OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltrationhttps://agentprime.io/advisories/CVE-2026-44696/https://agentprime.io/advisories/CVE-2026-44696/CVSS 5.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 19:30:51 GMTCVECVE-2026-49355: OpenProject: Private work package data disclosure through single meeting agenda item APIhttps://agentprime.io/advisories/CVE-2026-49355/https://agentprime.io/advisories/CVE-2026-49355/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 19:29:15 GMTCVECVE-2026-44736: OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjectshttps://agentprime.io/advisories/CVE-2026-44736/https://agentprime.io/advisories/CVE-2026-44736/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 19:27:54 GMTCVECVE-2026-46386: OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`https://agentprime.io/advisories/CVE-2026-46386/https://agentprime.io/advisories/CVE-2026-46386/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 19:26:39 GMTCVEcriticalCVE-2026-52780: OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)https://agentprime.io/advisories/CVE-2026-52780/https://agentprime.io/advisories/CVE-2026-52780/CVSS 9.6 (Critical). Critical: CVSS score 9.6: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 19:09:21 GMTCVEcriticalCVE-2026-52779: OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from unauthorized projectshttps://agentprime.io/advisories/CVE-2026-52779/https://agentprime.io/advisories/CVE-2026-52779/CVSS 5.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 19:02:50 GMTCVECVE-2026-47193: OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checkshttps://agentprime.io/advisories/CVE-2026-47193/https://agentprime.io/advisories/CVE-2026-47193/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 19:01:09 GMTCVECVE-2026-52781: OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"https://agentprime.io/advisories/CVE-2026-52781/https://agentprime.io/advisories/CVE-2026-52781/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 19:00:10 GMTCVECVE-2026-52782: OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resourceshttps://agentprime.io/advisories/CVE-2026-52782/https://agentprime.io/advisories/CVE-2026-52782/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 18:59:27 GMTCVEcriticalCVE-2026-52783: OpenProject: Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.<id>.httpx_access_token" leads to Sensitive Data Exposurehttps://agentprime.io/advisories/CVE-2026-52783/https://agentprime.io/advisories/CVE-2026-52783/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 18:57:58 GMTCVECVE-2026-52784: OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"https://agentprime.io/advisories/CVE-2026-52784/https://agentprime.io/advisories/CVE-2026-52784/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 18:56:06 GMTCVECVE-2026-52785: OpenProject: SQL injection in timestamps functionalityhttps://agentprime.io/advisories/CVE-2026-52785/https://agentprime.io/advisories/CVE-2026-52785/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 26 Jun 2026 18:54:03 GMTCVEcriticalCVE-2026-40896: OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookuphttps://agentprime.io/advisories/CVE-2026-40896/https://agentprime.io/advisories/CVE-2026-40896/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 20 Apr 2026 15:12:52 GMTCVECVE-2026-33667: OpenProject: 2FA OTP Verification Missing Rate Limitinghttps://agentprime.io/advisories/CVE-2026-33667/https://agentprime.io/advisories/CVE-2026-33667/CVSS 7.4 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Apr 2026 18:43:14 GMTCVECVE-2026-34717: OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_stringhttps://agentprime.io/advisories/CVE-2026-34717/https://agentprime.io/advisories/CVE-2026-34717/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Apr 2026 17:59:55 GMTCVEcriticalCVE-2026-32703: OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policyhttps://agentprime.io/advisories/CVE-2026-32703/https://agentprime.io/advisories/CVE-2026-32703/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Mar 2026 21:04:16 GMTCVEcriticalCVE-2026-32698: OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Executionhttps://agentprime.io/advisories/CVE-2026-32698/https://agentprime.io/advisories/CVE-2026-32698/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 18 Mar 2026 21:01:53 GMTCVEcriticalCVE-2026-31974: Blind SSRF on OpenProject instance via webhookshttps://agentprime.io/advisories/CVE-2026-31974/https://agentprime.io/advisories/CVE-2026-31974/CVSS 3.0 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 11 Mar 2026 19:39:25 GMTCVECVE-2026-30239: OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgetshttps://agentprime.io/advisories/CVE-2026-30239/https://agentprime.io/advisories/CVE-2026-30239/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 11 Mar 2026 16:27:31 GMTCVECVE-2026-30236: OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly ratehttps://agentprime.io/advisories/CVE-2026-30236/https://agentprime.io/advisories/CVE-2026-30236/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 11 Mar 2026 16:25:07 GMTCVECVE-2026-30235: Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobberinghttps://agentprime.io/advisories/CVE-2026-30235/https://agentprime.io/advisories/CVE-2026-30235/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 11 Mar 2026 16:06:43 GMTCVECVE-2026-30234: OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR)https://agentprime.io/advisories/CVE-2026-30234/https://agentprime.io/advisories/CVE-2026-30234/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 11 Mar 2026 15:59:11 GMTCVECVE-2026-27723: OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projectshttps://agentprime.io/advisories/CVE-2026-27723/https://agentprime.io/advisories/CVE-2026-27723/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Mar 2026 16:26:39 GMTCVECVE-2026-24777: OpenProject has Improper Access Control on User Management allows user managers to lock admin accountshttps://agentprime.io/advisories/CVE-2026-24777/https://agentprime.io/advisories/CVE-2026-24777/CVSS 6.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 09 Feb 2026 18:28:45 GMTCVECVE-2026-25763: Command Injection on OpenProject repositories leads to Remote Code Executionhttps://agentprime.io/advisories/CVE-2026-25763/https://agentprime.io/advisories/CVE-2026-25763/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Feb 2026 22:10:13 GMTCVEcriticalCVE-2026-25764: OpenProject vulnerable to Stored HTML injectionhttps://agentprime.io/advisories/CVE-2026-25764/https://agentprime.io/advisories/CVE-2026-25764/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Feb 2026 22:10:09 GMTCVECVE-2026-24776: OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transferhttps://agentprime.io/advisories/CVE-2026-24776/https://agentprime.io/advisories/CVE-2026-24776/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Feb 2026 17:56:11 GMTCVECVE-2026-24775: OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extensionhttps://agentprime.io/advisories/CVE-2026-24775/https://agentprime.io/advisories/CVE-2026-24775/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Jan 2026 18:10:46 GMTCVECVE-2026-24772: OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Serverhttps://agentprime.io/advisories/CVE-2026-24772/https://agentprime.io/advisories/CVE-2026-24772/CVSS 8.9 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Jan 2026 18:07:02 GMTCVECVE-2026-24685: OpenProject has Argument Injection on Repository module that allows Arbitrary File Writehttps://agentprime.io/advisories/CVE-2026-24685/https://agentprime.io/advisories/CVE-2026-24685/CVSS 9.4 (Critical). Critical: CVSS score 9.4: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 28 Jan 2026 16:47:22 GMTCVEcriticalCVE-2026-23721: OpenProject users with "View Members" permission in any project can view all Group membershipshttps://agentprime.io/advisories/CVE-2026-23721/https://agentprime.io/advisories/CVE-2026-23721/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Jan 2026 17:52:35 GMTCVECVE-2026-23646: OpenProject users can delete other user's session, causing them to be logged outhttps://agentprime.io/advisories/CVE-2026-23646/https://agentprime.io/advisories/CVE-2026-23646/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Jan 2026 17:48:03 GMTCVECVE-2026-23625: OpenProject has stored XSS regression using attachments and script-src selfhttps://agentprime.io/advisories/CVE-2026-23625/https://agentprime.io/advisories/CVE-2026-23625/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 19 Jan 2026 17:41:41 GMTCVECVE-2026-22605: OpenProject is Vulnerable to Insecure Direct Object Reference in Meetingshttps://agentprime.io/advisories/CVE-2026-22605/https://agentprime.io/advisories/CVE-2026-22605/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 10 Jan 2026 01:07:10 GMTCVECVE-2026-22604: OpenProject is vulnerable to user enumeration via the change password functionhttps://agentprime.io/advisories/CVE-2026-22604/https://agentprime.io/advisories/CVE-2026-22604/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 10 Jan 2026 01:07:02 GMTCVECVE-2026-22603: OpenProject has no protection against brute-force attacks in the Change Password functionhttps://agentprime.io/advisories/CVE-2026-22603/https://agentprime.io/advisories/CVE-2026-22603/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 10 Jan 2026 01:06:28 GMTCVECVE-2026-22602: OpenProject is Vulnerable to User Enumeration via User IDhttps://agentprime.io/advisories/CVE-2026-22602/https://agentprime.io/advisories/CVE-2026-22602/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Sat, 10 Jan 2026 01:06:12 GMTCVECVE-2026-22601: OpenProject is Vulnerable to Code Execution in E-Mail functionhttps://agentprime.io/advisories/CVE-2026-22601/https://agentprime.io/advisories/CVE-2026-22601/CVSS 8.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 10 Jan 2026 01:06:05 GMTCVECVE-2026-22600: OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coderhttps://agentprime.io/advisories/CVE-2026-22600/https://agentprime.io/advisories/CVE-2026-22600/CVSS 9.1 (Critical). Critical: CVSS score 9.1: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Sat, 10 Jan 2026 01:06:00 GMTCVEcriticalCVE-2025-24892: OpenProject stored HTML injection vulnerabilityhttps://agentprime.io/advisories/CVE-2025-24892/https://agentprime.io/advisories/CVE-2025-24892/CVSS 3.5 (Low). Published by the CVE Program. Not analysed by agentprime yet.Mon, 10 Feb 2025 15:46:29 GMTCVECVE-2024-41801: OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configurationhttps://agentprime.io/advisories/CVE-2024-41801/https://agentprime.io/advisories/CVE-2024-41801/CVSS 4.7 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 25 Jul 2024 16:50:16 GMTCVE