CVE-2026-31974

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, OpenProject SMTP test endpoint POST /admin/settings/mailnotifications accepts arbitrary host and port values and exhibits measurable differences in response behaviour depending on whether the target IP exists a...

EUVD-2026-11330

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, OpenProject SMTP test endpoint POST /admin/settings/mailnotifications accepts arbitrary host and port values and exhibits measurable differences in response behaviour depending on whether the target IP exists a...

CVE-2026-31974

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, OpenProject SMTP test endpoint POST /admin/settings/mailnotifications accepts arbitrary host and port values and exhibits measurable differences in response behaviour depending on whether the target IP exists a...

CVE-2026-31974

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, OpenProject SMTP test endpoint POST /admin/settings/mailnotifications accepts arbitrary host and port values and exhibits measurable differences in response behaviour depending on whether the target IP exists a...

CVE-2026-31974 Blind SSRF on OpenProject instance via webhooks

OpenProject is an open-source, web-based project management software. Prior to 17.2.0, OpenProject SMTP test endpoint POST /admin/settings/mailnotifications accepts arbitrary host and port values and exhibits measurable differences in response behaviour depending on whether the target IP exists a...

CVE-2019-25468

NetGain EM Plus 10.1.68 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious parameters to the scripttest.jsp endpoint. Attackers can send POST requests with shell commands embedded in the 'content'...

CVE-2019-25468

NetGain EM Plus 10.1.68 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious parameters to the scripttest.jsp endpoint. Attackers can send POST requests with shell commands embedded in the 'content'...

CVE-2019-25468 NetGain EM Plus 10.1.68 Remote Code Execution via script_test.jsp

NetGain EM Plus 10.1.68 contains a remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary system commands by submitting malicious parameters to the scripttest.jsp endpoint. Attackers can send POST requests with shell commands embedded in the 'content'...

com.buschmais.jqassistant.cli:application (>=1.7.0-rc1, <=2.10.0-m4), com.buschmais.jqassistant.cli:jqassistant-commandline-distribution (>=2.0.0-m3, <=2.0.10) +115 more potentially affected by CVE-2026-1524 via org.neo4j.community:it-test-support (>=3.5.0-beta02, <=5.26.21)

org.neo4j.community:it-test-support MAVEN version =3.5.0-beta02, =1.7.0-rc1, =2.0.0-m3, =1.7.0-rc1, =2.1.0-m1, =2.1.0-m1, =1.7.0-rc1, =1.7.0-rc1, =1.12.0-m1, =2.4.0-m1, =1.7.0-rc1, =1.10.0-alpha1, =2.0.0-rc2, =1.7.0-rc1, =1.7.0-rc1, =1.12.0-m1, =2.10.0-m4 and more Source cves: CVE-2026-1524 Sourc...

org.neo4j.gds:doc-test (>=2.18.0, <=2.22.0), org.neo4j.gds:doc-test-tools (>=2.18.0, <=2.22.0) +5 more potentially affected by CVE-2026-1524 via org.neo4j.community:it-test-support (>=2025.01.0, <=2026.01.4)

org.neo4j.community:it-test-support MAVEN version =2025.01.0, =2.18.0, =2.18.0, =2.18.0, =2.18.0, =2.18.0, =2025.01.0, =2025.02.0, =2026.01.4 Source cves: CVE-2026-1524 Source advisory: MEND:CVE-2026-1524...

OpenProject code-related vulnerabilities

OpenProject is an open-source web-based project management software. Versions of OpenProject prior to 17.2.0 had code vulnerabilities. These vulnerabilities stemmed from SMTP test endpoints and Webhooks, which allowed any host and port value to be accepted, potentially leading to internal network...

Apache Tomcat Client Certificate Validation Flaw Vulnerability

Apache Tomcat is the United States Apache Apache Foundation of a lightweight Web application server for the implementation of Servlet and JavaServer Page JSP support. Apache Tomcat client certificate has a validation flaw vulnerability, the vulnerability is due to allow revoked certificate/test...

com.vaadin:vaadin-platform-test (10.0.12) potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.12)

com.vaadin:vaadin MAVEN version 10.0.12 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.12 Source cves: CVE-2026-2742 Source advisory: OSV:GHSA-RJGH-WGC7-M37J...

com.vaadin:vaadin-platform-test (10.0.14) potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.14)

com.vaadin:vaadin MAVEN version 10.0.14 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.14 Source cves: CVE-2026-2742 Source advisory: OSV:GHSA-RJGH-WGC7-M37J...

com.vaadin:vaadin-platform-test (10.0.17) potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.17)

com.vaadin:vaadin MAVEN version 10.0.17 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.17 Source cves: CVE-2026-2742 Source advisory: OSV:GHSA-RJGH-WGC7-M37J...

com.vaadin:vaadin-platform-test (10.0.20) potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.20)

com.vaadin:vaadin MAVEN version 10.0.20 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.20 Source cves: CVE-2026-2742 Source advisory: OSV:GHSA-RJGH-WGC7-M37J...

com.vaadin:vaadin-platform-test (10.0.10), org.rapidpm:rapidpm-vaadin-testbench-ng-m-framework-v10 (>=01.00.02-rpm, <=01.00.03-rpm) +1 more potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.10)

com.vaadin:vaadin MAVEN version 10.0.10 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.10 - org.rapidpm:rapidpm-vaadin-testbench-ng-m-framework-v10 =01.00.02-rpm,...

com.vaadin:vaadin-platform-test (11.0.2) potentially affected by CVE-2026-2742 via com.vaadin:vaadin (11.0.2)

com.vaadin:vaadin MAVEN version 11.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 11.0.2 Source cves: CVE-2026-2742 Source advisory: OSV:GHSA-RJGH-WGC7-M37J...

com.vaadin:vaadin-platform-test (10.0.4) potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.4)

com.vaadin:vaadin MAVEN version 10.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.4 Source cves: CVE-2026-2742 Source advisory: OSV:GHSA-RJGH-WGC7-M37J...

com.vaadin:vaadin-platform-test (10.0.13) potentially affected by CVE-2026-2742 via com.vaadin:vaadin (10.0.13)

com.vaadin:vaadin MAVEN version 10.0.13 is affected by a known vulnerability. The following packages have a transitive dependency on com.vaadin:vaadin and may be impacted: - com.vaadin:vaadin-platform-test 10.0.13 Source cves: CVE-2026-2742 Source advisory: OSV:GHSA-RJGH-WGC7-M37J...