CVE-2026-44735

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the viewsharedworkpackages permission. The authorization check operates at the project level onl...

CVE-2026-44736

OpenProject vulnerability CVE-2026-44736 affects the OpenProject web-based project management platform. The flaw exists in the GET /api/v3/relations endpoint prior to version 17.4.0, allowing any authenticated user to retrieve relations and the titles of work packages they should not have permiss...

MAL-2022-6587 Malicious code in titles (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware abd4ff58249068e7da5354d6c1c536d8d1c88de26e977798b1965f29fb3d91bc Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...