Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 8 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 401,234All CVEsplus 19,120 rejected
- 500Last 24 hours2,797 in the last 7 days
- 16,901Last 30 days1,543 of them critical
- 1,768Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 10 | 8 | 27 | 3 | 0 | 48 | 55 |
| 2025 | 0 | 0 | 0 | 1 | 0 | 1 | 7 |
| 2024 | 0 | 1 | 1 | 0 | 0 | 2 | 6 |
| 2023 | 0 | 1 | 1 | 0 | 0 | 2 | 4 |
| 2022 | 0 | 0 | 0 | 0 | 0 | 0 | 2 |
| 2021 | 0 | 1 | 1 | 0 | 0 | 2 | 2 |
| Title | ||
|---|---|---|
| CVE-2026-55095 | OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fieldsopf · openproject | Medium5.3 |
| CVE-2026-67529 | OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)opf · openproject | Medium4.3 |
| CVE-2026-67528 | OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposureopf · openproject | Medium4.3 |
| CVE-2026-67527 | OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"opf · openproject | High7.6 |
| CVE-2026-44733 | OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirementsopf · openproject | Medium5.9 |
| CVE-2026-44731 | OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosureopf · openproject | Medium4.3 |
| CVE-2026-44732 | OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resourcesopf · openproject | Medium4.3 |
| CVE-2026-44734 | OpenProject: Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_reports/[REPORT_ID]/renameopf · openproject | Medium6.5 |
| CVE-2026-44735 | OpenProject: Shares API Information Disclosureopf · openproject | Medium6.5 |
| CVE-2026-44696 | OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltrationopf · openproject | Medium5.7 |
| CVE-2026-49355 | OpenProject: Private work package data disclosure through single meeting agenda item APIopf · openproject | Medium4.3 |
| CVE-2026-44736 | OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjectsopf · openproject | Medium6.5 |
| CVE-2026-46386 | OpenProject: Pre-authentication RCE in openproject/openproject Docker image via default `SECRET_KEY_BASE=OVERWRITE_ME` and `cookies_serializer = :marshal`opf · openproject | Critical9.9 |
| CVE-2026-52780 | OpenProject: Cache store poisoning leads to Remote Code Execution (RCE)opf · openproject | Critical9.6 |
| CVE-2026-52779 | OpenProject: Cross-project authorization bypass allows deleting public Calendar and Team Planner queries from unauthorized projectsopf · openproject | Medium5.4 |
| CVE-2026-47193 | OpenProject: Journal diff endpoint bypasses object, journal, and field visibility checksopf · openproject | High7.5 |
| CVE-2026-52781 | OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"opf · openproject | Medium6.4 |
| CVE-2026-52782 | OpenProject: IDOR through /projects/<A>/settings/project_storages/<A_ps_id> via PATCH parameter "storages_project_storage[project_folder_id]" leads to Access to Unauthorized Resourcesopf · openproject | Critical9.9 |
| CVE-2026-52783 | OpenProject: Information Disclosure (cleartext storage of data) on localhost through memcached via Others "storage.<id>.httpx_access_token" leads to Sensitive Data Exposureopf · openproject | High8.2 |
| CVE-2026-52784 | OpenProject: CSRF on TARGET through /users/:id via POST parameter "user[admin]"opf · openproject | High8.8 |
| CVE-2026-52785 | OpenProject: SQL injection in timestamps functionalityopf · openproject | Critical9.9 |
| CVE-2026-40896 | OpenProject has Cross-Project Meeting Agenda Item Injection via Unscoped Section Lookupopf · openproject | Medium6.5 |
| CVE-2026-33667 | OpenProject: 2FA OTP Verification Missing Rate Limitingopf · openproject | High7.4 |
| CVE-2026-34717 | OpenProject: SQL Injection in Cost Reporting =n Operator via parse_number_stringopf · openproject | Critical9.9 |
| CVE-2026-32703 | OpenProject's repository files are served with the MIME type allowing them to be used to bypass Content Security Policyopf · openproject | Critical9.1 |
| CVE-2026-32698 | OpenProject has a SQL Injection via Custom Field Name that can be chained to Remote Code Executionopf · openproject | Critical9.1 |
| CVE-2026-31974 | Blind SSRF on OpenProject instance via webhooksopf · openproject | Low3.0 |
| CVE-2026-30239 | OpenProject has a Permission Check bypass on Budget deletion allows reassignment of WorkPackages into other budgetsopf · openproject | Medium6.5 |
| CVE-2026-30236 | OpenProject users that are not project members can be used to calculate Labor Budget, leaking their global hourly rateopf · openproject | Medium4.3 |
| CVE-2026-30235 | Business Logic Error on OpenProject through hyperlinks in markdown using DOM clobberingopf · openproject | Medium6.5 |
| CVE-2026-30234 | OpenProject BIM BCF XML Import: <Snapshot> Path Traversal Leads to Arbitrary Local File Read (AFR)opf · openproject | Medium6.5 |
| CVE-2026-27723 | OpenProject: Insufficient access control leads to create Wiki objects belongs unpermitted projectsopf · openproject | Medium4.3 |
| CVE-2026-24777 | OpenProject has Improper Access Control on User Management allows user managers to lock admin accountsopf · openproject | Medium6.7 |
| CVE-2026-25763 | Command Injection on OpenProject repositories leads to Remote Code Executionopf · openproject | Critical9.4 |
| CVE-2026-25764 | OpenProject vulnerable to Stored HTML injectionopf · openproject | Low3.5 |
| CVE-2026-24776 | OpenProject has an IDOR on MeetingAgendaItems allows cross-project meeting agenda item transferopf · openproject | Medium4.3 |
| CVE-2026-24775 | OpenProject has Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extensionopf · openproject | Medium6.3 |
| CVE-2026-24772 | OpenProject has SSRF and CSWSH in Hocuspocus Synchronization Serveropf · openproject | High8.9 |
| CVE-2026-24685 | OpenProject has Argument Injection on Repository module that allows Arbitrary File Writeopf · openproject | Critical9.4 |
| CVE-2026-23721 | OpenProject users with "View Members" permission in any project can view all Group membershipsopf · openproject | Medium4.3 |
| CVE-2026-23646 | OpenProject users can delete other user's session, causing them to be logged outopf · openproject | Medium6.5 |
| CVE-2026-23625 | OpenProject has stored XSS regression using attachments and script-src selfopf · openproject | High8.7 |
| CVE-2026-22605 | OpenProject is Vulnerable to Insecure Direct Object Reference in Meetingsopf · openproject | Medium4.3 |
| CVE-2026-22604 | OpenProject is vulnerable to user enumeration via the change password functionopf · openproject | Medium6.9 |
| CVE-2026-22603 | OpenProject has no protection against brute-force attacks in the Change Password functionopf · openproject | Medium6.9 |
| CVE-2026-22602 | OpenProject is Vulnerable to User Enumeration via User IDopf · openproject | Low3.5 |
| CVE-2026-22601 | OpenProject is Vulnerable to Code Execution in E-Mail functionopf · openproject | High8.6 |
| CVE-2026-22600 | OpenProject is Vulnerable to Arbitrary File Read via ImageMagick SVG Coderopf · openproject | Critical9.1 |
| CVE-2025-24892 | OpenProject stored HTML injection vulnerabilityopf · openproject | Low3.5 |
| CVE-2024-41801 | OpenProject packaged installation has Open Redirect Vulnerability in Sign-In in default configurationopf · openproject | Medium4.7 |