CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 5:30 PM ET)

What this means for you

This week: 3,218 CVEs published, 238 critical, and 5 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,218; Show in the list
Critical, last 7 days: 238; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product opf:openproject. Show all products

48 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-55095	Medium 5.3	OpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields Assigned by GitHub_M	Aug 20, 2026
CVE-2026-67529	Medium 4.3	OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check) Assigned by GitHub_M	Jul 30, 2026
CVE-2026-67528	Medium 4.3	OpenProject: Improper Access Control through /api/v3/custom_options/:id via Path "id" leads to Sensitive Data Exposure Assigned by GitHub_M	Jul 30, 2026
CVE-2026-67527	High 7.6	OpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks" Assigned by GitHub_M	Jul 30, 2026
CVE-2026-44733	Medium 5.9	OpenProject: Business Logic Error on OpenProject through PATCH request to /api/v3/users/me permits to bypass password requirements Assigned by GitHub_M	Jun 26, 2026
CVE-2026-44731	Medium 4.3	OpenProject: Improper Access Control on OpenProject through /projects/[projectName]/meetings via "invited_user_id" in GET parameter "filters" leads to user names disclosure Assigned by GitHub_M	Jun 26, 2026
CVE-2026-44732	Medium 4.3	OpenProject: IDOR on OpenProject through /api/v3/documents/{id} via PATCH parameter "project_id" leads to Unauthorized Modification of Resources Assigned by GitHub_M	Jun 26, 2026
CVE-2026-44734	Medium 6.5	OpenProject: Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_reports/[REPORT_ID]/rename Assigned by GitHub_M	Jun 26, 2026
CVE-2026-44735	Medium 6.5	OpenProject: Shares API Information Disclosure Assigned by GitHub_M	Jun 26, 2026
CVE-2026-44696	Medium 5.7	OpenProject: Stored CSS injection via Sanitize::Config::RELAXED[:css] enables phishing overlays and data exfiltration Assigned by GitHub_M	Jun 26, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.