GHSA-M2V9-299J-RV96 vulnerabilities

Vulnerabilities for packages: open-webui...

GHSA-VGWF-H737-FF37 vulnerabilities

Vulnerabilities for packages: podman, prometheus, kaf, kubernetes, argocd-image-updater, kyverno, kine, witness, docker-machine-driver-harvester, pulumi-language-java, pulumi-kubernetes-operator, flux, opentelemetry-collector, k3s, scorecard, snyk-cli, flux-source-controller, docker, rancher-agen...

GHSA-X527-X647-Q7GG vulnerabilities

Vulnerabilities for packages: prometheus, external-secrets-operator, rancher-agent, chisel, falco-no-driver, kaf, prometheus-operator, skaffold, trivy-operator, nerdctl, kubescape, gitea, minio, spire-server, kubernetes, cilium-cli, gitlab-kas, argocd-image-updater, kots, zot, kyverno, zarf, aact...

GHSA-89GR-R52H-F8RX vulnerabilities

Vulnerabilities for packages: podman, prometheus, openbao, step, caddy, kaf, cosign, kubernetes, terraform-provider-tls, argocd-image-updater, glab, kyverno, kine, witness, docker-machine-driver-harvester, pulumi-language-java, pulumi-kubernetes-operator, flux, opentelemetry-collector, k3s,...

GHSA-F5WC-C3C7-36MC vulnerabilities

Vulnerabilities for packages: podman, prometheus, openbao, step, caddy, kaf, kubernetes, argocd-image-updater, kyverno, kine, witness, docker-machine-driver-harvester, pulumi-language-java, pulumi-kubernetes-operator, flux, opentelemetry-collector, k3s, scorecard, snyk-cli, flux-source-controller...

GHSA-QPW4-5X99-6VJP vulnerabilities

Vulnerabilities for packages: podman, prometheus, kaf, kubernetes, argocd-image-updater, kyverno, kine, witness, docker-machine-driver-harvester, pulumi-language-java, pulumi-kubernetes-operator, flux, opentelemetry-collector, k3s, scorecard, snyk-cli, flux-source-controller, docker, rancher-agen...

GHSA-45GG-VH54-H5M9 vulnerabilities

Vulnerabilities for packages: prometheus, external-secrets-operator, rancher-agent, chisel, falco-no-driver, kaf, prometheus-operator, skaffold, trivy-operator, nerdctl, kubescape, gitea, minio, spire-server, kubernetes, cilium-cli, gitlab-kas, argocd-image-updater, kots, zot, kyverno, zarf, aact...

GHSA-Q4H4-GMJ2-QVW2 vulnerabilities

Vulnerabilities for packages: podman, crossplane-provider-aws-lambda, prometheus, openbao, step, caddy, kaf, cosign, terraform-provider-acme, kubernetes, docker-machine-driver-linode, terraform-provider-tls, crossplane-provider-aws-route53, argocd-image-updater, glab,...

CVE-2026-44735 OpenProject: Shares API Information Disclosure

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the viewsharedworkpackages permission. The authorization check operates at the project level onl...

CVE-2026-44735

Technical details for CVE-2026-44735 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-44735

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the viewsharedworkpackages permission. The authorization check operates at the project level onl...

EUVD-2026-39880

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the viewsharedworkpackages permission. The authorization check operates at the project level onl...

CVE-2026-44735 OpenProject: Shares API Information Disclosure

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the viewsharedworkpackages permission. The authorization check operates at the project level onl...

CVE-2026-44735 OpenProject: Shares API Information Disclosure

OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, the GET /api/v3/shares endpoint returns share details for ALL work packages in a project to any user with the viewsharedworkpackages permission. The authorization check operates at the project level onl...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: libtiff: libtiff-4.7.1-2.2.hum1 aarch64, x8664 libtiff-devel-4.7.1-2.2.hum1 aarch64, x8664 libtiff-static-4.7.1-2.2.hum1 aarch64, x8664 libtiff-tools-4.7.1-2.2.hum1 aarch64, x8664...

CVE-2026-44736 OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects

OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject title of work packages they have no permission to view — by supplying an arbitrary work package ID in the...

CVE-2026-44736 OpenProject: Relations API Filter Bypasses Visibility Scope, Leaking Cross-Project Work Package Subjects

OpenProject is open-source, web-based project management software. Prior to 17.4.0, the GET /api/v3/relations endpoint allows any authenticated user to retrieve relations — and the subject title of work packages they have no permission to view — by supplying an arbitrary work package ID in the...

CVE-2026-52781 OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants elements unrestricted data- attributes via :data wildcard. An attacker injects data-controller="poll-for-changes" into a work package description, causing Stimulus.js to mount ...

CVE-2026-52781

OpenProject CVE-2026-52781 affects the open-source, web-based project management software. Prior to versions 17.3.3 and 17.4.1, the HTML sanitizer allowed elements to have unrestricted data-* attributes via a :data wildcard. An attacker could inject data-controller="poll-for-changes" into a work...

CVE-2026-52781 OpenProject: Stored XSS on openproject.example.com through /api/v3/projects/{project}/work_packages via POST parameter "description"

OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the HTML sanitizer grants elements unrestricted data- attributes via :data wildcard. An attacker injects data-controller="poll-for-changes" into a work package description, causing Stimulus.js to mount ...