CVE-2026-49355: Exposure of Sensitive Information to an Unauthorized Actor

OpenProject is open-source, web-based project management software. Prior to 17.4.0, GET /api/v3/meetings/:meetingid/agendaitems/:agendaitemid discloses private work package data from a linked work package that belongs to a private/inaccessible project. This vulnerability is fixed in 17.4.0...

CVE-2026-25058: Missing Authentication for Critical Function

Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa transcription-collector service exposes an internal endpoint GET /internal/transcripts/meetingid that returns transcript data for any meeting without any authentication or...

CVE-2017-7389: Improper Neutralization of Input During Web Page Generation

Multiple Cross-Site Scripting XSS were discovered in 'openeclass Release3.5.4'. The vulnerabilities exist due to insufficient filtration of user-supplied data meetingid, user passed to the 'openeclass-master/modules/tc/webconf/webconf.php' URL. An attacker could execute arbitrary HTML and script...

Webinars v2.2.26.0 - Client Side Cross Site Vulnerability

Document Title: =============== Webinars v2.2.26.0 - Client Side Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1412 Release Date: ============= 2015-01-19 Vulnerability Laboratory ID VL-ID: ====================================...

Webinars v2.2.26.0 - Client Side Cross Site Vulnerability

Document Title: =============== Webinars v2.2.26.0 - Client Side Cross Site Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1412 Release Date: ============= 2015-01-19 Vulnerability Laboratory ID VL-ID: ====================================...