CVE-2026-67529

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/timeentries and GET /api/v3/costentries rendered links.workPackage.title and links.workPackage.href through associatedresource in modules/costs/lib/api/v3/timeentries/timeentryrepresenter.rb and...

EUVD-2026-51292

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/timeentries and GET /api/v3/costentries rendered links.workPackage.title and links.workPackage.href through associatedresource in modules/costs/lib/api/v3/timeentries/timeentryrepresenter.rb and...

CVE-2026-67529 OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/timeentries and GET /api/v3/costentries rendered links.workPackage.title and links.workPackage.href through associatedresource in modules/costs/lib/api/v3/timeentries/timeentryrepresenter.rb and...

CVE-2026-67529

OpenProject prior to 17.6.0 exposes private work package details via GET /api/v3/time_entries and GET /api/v3/cost_entries. The time_entry_representer.rb and cost_entry_representer.rb modules render _links.workPackage.title and _links.workPackage.href without checking WorkPackage.visible or view_...

CVE-2026-67529 OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/timeentries and GET /api/v3/costentries rendered links.workPackage.title and links.workPackage.href through associatedresource in modules/costs/lib/api/v3/timeentries/timeentryrepresenter.rb and...

CVE-2026-67529 OpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)

OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/timeentries and GET /api/v3/costentries rendered links.workPackage.title and links.workPackage.href through associatedresource in modules/costs/lib/api/v3/timeentries/timeentryrepresenter.rb and...

CVE-2026-51268

creationtimestamp| type| source ---|---|--- 2026-07-30 18:50:06+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mrv477ouem2k 2026-07-30 20:01:35+00:00| seen| https://bsky.app/profile/bootintel.bsky.social/post/3mrva6zooad2n...

CVE-2026-67174

creationtimestamp| type| source ---|---|--- 2026-07-30 17:48:08+00:00| seen| https://bsky.app/profile/stackflag.bsky.social/post/3mruyqccvhz2e...

SUSE CVE-2026-17951

Heap buffer overflow in WebRTC in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. Chromium security severity: Low...

SUSE CVE-2026-20779

Gitea versions from 1.5.0 before 1.26.3 have a TOTP single-use enforcement defect that allows a valid TOTP code to be accepted more than once across web two-factor authentication flows and the Basic Auth X-Gitea-OTP path...

SUSE CVE-2026-35597

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional due to a database transaction handling bug. When a TOTP validation fails, the login handler in pkg/routes/api/v1/login.go calls HandleFailedTOTPAuth and then...

SUSE CVE-2026-35599

Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatIntervalToTime function uses an On loop that advances a date by the task's RepeatAfter duration until it exceeds the current time. By creating a repeating task with a 1-second interval and a due date far ...

CVE-2026-57862

creationtimestamp| type| source ---|---|--- 2026-07-30 16:15:05+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/ilw4ytaebzud5...

CVE-2026-67346

creationtimestamp| type| source ---|---|--- 2026-07-30 15:49:07+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/6y3reb6zoq65d...

CVE-2026-28813

creationtimestamp| type| source ---|---|--- 2026-07-30 14:25:09+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/dmiispwlcnpj3...

CVE-2026-60075

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime. parsetime removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time...

CVE-2026-60075

Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime. parsetime removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time...

CVE-2026-60075 Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime. parsetime removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time...

EUVD-2026-51125

Date::Manip versions through 6.99 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime. parsetime removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time...

CVE-2026-60075 Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in _parse_time

Date::Manip versions through 7.00 for Perl allow CPU exhaustion via quadratic backtracking in the unanchored time substitution in parsetime. parsetime removes a time from anywhere in the string with the unanchored substitution s/$timerx/ /, where $timerx is an auto-generated alternation of time...