CVE-2026-49355 OpenProject: Private work package data disclosure through single meeting agenda item API

OpenProject is open-source, web-based project management software. Prior to 17.4.0, GET /api/v3/meetings/:meetingid/agendaitems/:agendaitemid discloses private work package data from a linked work package that belongs to a private/inaccessible project. This vulnerability is fixed in 17.4.0...

CVE-2025-62028 WordPress Salient theme < 17.4.0 - Broken Access Control vulnerability

Missing Authorization vulnerability in ThemeNectar Salient salient.This issue affects Salient: from n/a through 17.4.0...