Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
216 results · page 3 of 5
Mar 6, 2026Plane is an an open-source project management tool.CVE-2026-30244 · Other software · makeplane · reported by GitHubHigh 7.5
Plane is an an open-source project management tool. Prior to version 1.2.2, unauthenticated attackers can enumerate workspace members and extract sensitive information including email addresses, user roles, and internal identifiers. The vulnerability stems from Django REST Framework permission classes being incorrectly configured to allow anonymous access to protected endpoints. This issue has been patched in version 1.2.2.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2026Plane is an an open-source project management tool.CVE-2026-30242 · Other software · makeplane · reported by GitHubHigh 8.5
Plane is an an open-source project management tool. Prior to version 1.2.3, the webhook URL validation in plane/app/serializers/webhook.py only checks ip.is_loopback, allowing attackers with workspace ADMIN role to create webhooks pointing to private/internal network addresses (10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254, etc.). When webhook events fire, the server makes requests to these internal addresses and stores the response — enabling SSRF with full response read-back. This issue has been patched in version 1.2.3.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 5, 2026OpenProject is an open-source, web-based project management software.CVE-2026-27723 · Other software · opf · reported by GitHubMedium 4.3
OpenProject is an open-source, web-based project management software. Prior to versions 17.0.5 and 17.1.2, an attacker can create wiki pages belonging to unpermitted projects through an improperly authenticated request. This issue has been patched in versions 17.0.5 and 17.1.2.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Initiative is a self-hosted project management platform.CVE-2026-28276 · Other software · Morelitea · reported by GitHubHigh 7.5
Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents are served from a publicly accessible /uploads/ directory without any authentication or authorization checks. Any uploaded file can be accessed directly via its URL by unauthenticated users (e.g., in an incognito browser session), leading to potential disclosure of sensitive documents. The problem was patched in v0.32.2, and the patch was further improved on in 032.4.
- Product
- initiative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Initiative is a self-hosted project management platform.CVE-2026-28275 · Other software · Morelitea · reported by GitHubHigh 8.1
Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 do not invalidate previously issued JWT access tokens after a user changes their password. As a result, older tokens remain valid until expiration and can still be used to access protected API endpoints. This behavior allows continued authenticated access even after the account password has been updated. Version 0.32.4 fixes the issue.
- Product
- initiative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 26, 2026Initiative is a self-hosted project management platform.CVE-2026-28274 · Other software · Morelitea · reported by GitHubHigh 8.7
Initiative is a self-hosted project management platform. Versions of the application prior to 0.32.4 are vulnerable to Stored Cross-Site Scripting (XSS) in the document upload functionality. Any user with upload permissions within the "Initiatives" section can upload a malicious `.html` or `.htm` file as a document. Because the uploaded HTML file is served under the application's origin without proper sandboxing, the embedded JavaScript executes in the context of the application. As a result, authentication tokens, session cookies, or other sensitive data can be exfiltrated to an attacker-controlled server. Additionally, since the uploaded file is hosted under the application's domain, simply sharing the direct file link may result in execution of the malicious script when accessed. Version 0.32.4 fixes the issue.
- Product
- initiative
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Plane is an an open-source project management tool.CVE-2026-27706 · Other software · makeplane · reported by GitHubHigh 7.7
Plane is an an open-source project management tool. Prior to version 1.2.2, a Full Read Server-Side Request Forgery (SSRF) vulnerability has been identified in the "Add Link" feature. This flaw allows an authenticated attacker with general user privileges to send arbitrary GET requests to the internal network and exfiltrate the full response body. By exploiting this vulnerability, an attacker can steal sensitive data from internal services and cloud metadata endpoints. Version 1.2.2 fixes the issue.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 25, 2026Plane is an an open-source project management tool.CVE-2026-27705 · Other software · makeplane · reported by GitHubMedium 4.9
Plane is an an open-source project management tool. Prior to version 1.2.2, the `ProjectAssetEndpoint.patch()` method in `apps/api/plane/app/views/asset/v2.py` (lines 579–593) performs a global asset lookup using only the asset ID (`pk`) via `FileAsset.objects.get(id=pk)`, without verifying that the asset belongs to the workspace and project specified in the URL path. This allows any authenticated user (including those with the GUEST role) to modify the `attributes` and `is_uploaded` status of assets belonging to any workspace or project in the entire Plane instance by guessing or enumerating asset UUIDs. Version 1.2.2 fixes the issue.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 18, 2026WPNakama – Team and multi-Client Collaboration, Editorial and Project Management: SQL InjectionCVE-2026-2495 · WordPress plugins & themes · reported by WordfenceHigh 7.5
The WPNakama – Team and multi-Client Collaboration, Editorial and Project Management plugin for WordPress is vulnerable to SQL Injection via the 'order' parameter of the '/wp-json/WPNakama/v1/boards' REST API endpoint in all versions up to, and including, 0.6.5. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- WPNakama – Team and multi-Client Collaboration, Editorial and Project Management
- Affected
- up to 0.6.5
- What to do
- Affects up to 0.6.5. Update WPNakama – Team and multi-Client Collaboration, Editorial and Project Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 2026Taskbuilder – WordPress Project Management & Task Management: Authorization bypassCVE-2026-1640 · WordPress plugins & themes · reported by WordfenceMedium 4.3
The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.2. This is due to missing authorization checks on the project and task comment submission functions (AJAX actions: wppm_submit_proj_comment and wppm_submit_task_comment). This makes it possible for authenticated attackers, with subscriber-level access and above, to create comments on any project or task (including private projects they cannot view or are not assigned to), and inject arbitrary HTML and CSS via the insufficiently sanitized comment_body parameter.
- Product
- Taskbuilder – WordPress Project Management & Task Management
- Affected
- up to 5.0.2
- What to do
- Affects up to 5.0.2. Update Taskbuilder – WordPress Project Management & Task Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 18, 2026Taskbuilder – WordPress Project Management & Task Management: Time-based blind SQL InjectionCVE-2026-1639 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'order' and 'sort_by' parameters in all versions up to, and including, 5.0.2 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Taskbuilder – WordPress Project Management & Task Management
- Affected
- up to 5.0.2
- What to do
- Affects up to 5.0.2. Update Taskbuilder – WordPress Project Management & Task Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Feb 13, 2026Kanboard is project management software focused on Kanban methodology.CVE-2026-25531 · Other software · kanboard · reported by GitHubMedium 4.3
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, The fix for CVE-2023-33968 is incomplete. The TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects, allowing authenticated users to duplicate tasks into projects they cannot access. This vulnerability is fixed in 1.2.50.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 11, 2026Kanboard is project management software focused on Kanban methodology.CVE-2026-25924 · Other software · kanboard · reported by GitHubHigh 8.4
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a security control bypass vulnerability in Kanboard allows an authenticated administrator to achieve full Remote Code Execution (RCE). Although the application correctly hides the plugin installation interface when the PLUGIN_INSTALLER configuration is set to false, the underlying backend endpoint fails to verify this security setting. An attacker can exploit this oversight to force the server to download and install a malicious plugin, leading to arbitrary code execution. This vulnerability is fixed in 1.2.50.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Worklenz is a project management tool.CVE-2026-25947 · Other software · Worklenz · reported by GitHubHigh 8.8
Worklenz is a project management tool. Prior to 2.1.7, there are multiple SQL injection vulnerabilities were discovered in backend SQL query construction affecting project and task management controllers, reporting and financial data endpoints, real-time socket.io handlers, and resource allocation and scheduling features. The vulnerability has been patched in version v2.1.7.
- Product
- worklenz
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Kanboard is project management software focused on Kanban methodology.CVE-2026-25530 · Other software · kanboard · reported by GitHubMedium 4.3
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, the getSwimlane API method lacks project-level authorization, allowing authenticated users to access swimlane data from projects they cannot access. This vulnerability is fixed in 1.2.50.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2026Kanboard is project management software focused on Kanban methodology.CVE-2026-24885 · Other software · kanboard · reported by GitHubMedium 5.7
Kanboard is project management software focused on Kanban methodology. Prior to 1.2.50, a Cross-Site Request Forgery (CSRF) vulnerability exists in the ProjectPermissionController within the Kanboard application. The application fails to strictly enforce the application/json Content-Type for the changeUserRole action. Although the request body is JSON, the server accepts text/plain, allowing an attacker to craft a malicious form using the text/plain attribute. Which allows unauthorized modification of project user roles if an authenticated admin visits a malicious site This vulnerability is fixed in 1.2.50.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 9, 2026OpenProject is an open-source, web-based project management software.CVE-2026-24777 · Other software · opf · reported by GitHubMedium 6.7
OpenProject is an open-source, web-based project management software. Prior to 17.0.2, users with the Manage Users permission can lock and unlock users. This functionality should only be possible for users of the application, but they were not supposed to be able to lock application administrators. Due to a missing permission check this logic was not enforced. The problem was fixed in OpenProject 17.0.2The problem was fixed in OpenProject 17.0.2.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026OpenProject is an open-source, web-based project management software.CVE-2026-25764 · Other software · opf · reported by GitHubLow 3.5
OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injection vulnerability occurs in the time tracking function of OpenProject. The application does not escape HTML tags, an attacker with administrator privileges can create a work package with the name containing the HTML tags and add it to the Work package section when creating time tracking. This issue has been patched in versions 16.6.7 and 17.0.3.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026OpenProject is an open-source, web-based project management software.CVE-2026-25763 · Other software · opf · reported by GitHubCritical 9.4
OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an arbitrary file write vulnerability exists in OpenProject’s repository changes endpoint (/projects/:project_id/repository/changes) when rendering the “latest changes” view via git log. By supplying a specially crafted rev value (for example, rev=--output=/tmp/poc.txt), an attacker can inject git log command-line options. When OpenProject executes the SCM command, Git interprets the attacker-controlled rev as an option and writes the output to an attacker-chosen path. As a result, any user with the :browse_repository permission on the project can create or overwrite arbitrary files that the OpenProject process user is permitted to write. The written contents consist of git log output, but by crafting custom commits the attacker can still upload valid shell scripts, ultimately leading to RCE. The RCE lets the attacker create a reverse shell to the target host and view confidential files outside of OpenProject, such as /etc/passwd. This issue has been patched in versions 16.6.7 and 17.0.3.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 6, 2026OpenProject is an open-source, web-based project management software.CVE-2026-24776 · Other software · opf · reported by GitHubMedium 4.3
OpenProject is an open-source, web-based project management software. Prior to 17.0.2, the drag&drop handler moving an agenda item to a different section was not properly checking if the target meeting section is part of the same meeting (or is the backlog, in case of recurring meetings). This allowed an attacker to move a meeting agenda item into a different meeting. The attacker did not get access to meetings, but they could add arbitrary agenda items, that could cause confusions. The vulnerability is fixed in 17.0.2.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026OpenProject is an open-source, web-based project management software.CVE-2026-24775 · Other software · opf · reported by GitHubMedium 6.3
OpenProject is an open-source, web-based project management software. In the new editor for collaborative documents based on BlockNote, OpenProject maintainers added a custom extension in OpenProject version 17.0.0 that allows to mention OpenProject work packages in the document. To show work package details, the editor loads details about the work package via the OpenProject API. For this API call, the extension to the BlockNote editor did not properly validate the given work package ID to be only a number. This allowed an attacker to generate a document with relative links that upon opening could make arbitrary `GET` requests to any URL within the OpenProject instance. This issue was patched in version version 0.0.22 of op-blocknote-extensions, which was shipped with OpenProject 17.0.2. If users cannot update immediately to version 17.0.2 of OpenProject, administrators can disable collaborative document editing in Settings -> Documents -> Real time collaboration -> Disable.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026OpenProject is an open-source, web-based project management software.CVE-2026-24772 · Other software · opf · reported by GitHubHigh 8.9
OpenProject is an open-source, web-based project management software. To enable the real time collaboration on documents, OpenProject 17.0 introduced a synchronization server. The OpenPrioject backend generates an authentication token that is currently valid for 24 hours, encrypts it with a shared secret only known to the synchronization server. The frontend hands this encrypted token and the backend URL over to the synchronization server to check user's ability to work on the document and perform intermittent saves while editing. The synchronization server does not properly validate the backend URL and sends a request with the decrypted authentication token to the endpoint that was given to the server. An attacker could use this vulnerability to decrypt a token that he intercepted by other means to gain an access token to interact with OpenProject on the victim's behalf. This vulnerability was introduced with OpenProject 17.0.0 and was fixed in 17.0.2. As a workaround, disable the collaboration feature via Settings -> Documents -> Real time collaboration -> Disable. Additionally the `hocuspocus` container should also be disabled.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 28, 2026OpenProject is an open-source, web-based project management software.CVE-2026-24685 · Other software · opf · reported by GitHubCritical 9.4
OpenProject is an open-source, web-based project management software. Versions prior to 16.6.6 and 17.0.2 have an arbitrary file write vulnerability in OpenProject’s repository diff download endpoint (`/projects/:project_id/repository/diff.diff`) when rendering a single revision via git show. By supplying a specially crafted rev value (for example, `rev=--output=/tmp/poc.txt)`, an attacker can inject git show command-line options. When OpenProject executes the SCM command, Git interprets the attacker-controlled rev as an option and writes the output to an attacker-chosen path. As a result, any user with the `:browse_repository` permission on the project can create or overwrite arbitrary files that the OpenProject process user is permitted to write. The written contents consist of git show output (commit metadata and patch), but overwriting application or configuration files still leads to data loss and denial of service, impacting integrity and availability. The issue has been fixed in OpenProject 17.0.2 and 16.6.6.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026OpenProject is an open-source, web-based project management software.CVE-2026-23721 · Other software · opf · reported by GitHubMedium 4.3
OpenProject is an open-source, web-based project management software. When using groups in OpenProject to manage users, the group members should only be visible to users that have the View Members permission in any project that the group is also a member of. Prior to versions 17.0.1 and 16.6.5, due to a failed permission check, if a user had the View Members permission in any project, they could enumerate all Groups and view which other users are part of the group. The issue has been fixed in OpenProject 17.0.1 and 16.6.5. No known workarounds are available.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026OpenProject is an open-source, web-based project management software.CVE-2026-23646 · Other software · opf · reported by GitHubMedium 6.5
OpenProject is an open-source, web-based project management software. Users of OpenProject versions prior to 16.6.5 and 17.0.1 have the ability to view and end their active sessions via Account Settings → Sessions. When deleting a session, it was not properly checked if the session belongs to the user. As the ID that is used to identify these session objects use incremental integers, users could iterate requests using `DELETE /my/sessions/:id` and thus unauthenticate other users. Users did not have access to any sensitive information (like browser identifier, IP addresses, etc) of other users that are stored in the session. The problem was patched in OpenProject versions 16.6.5 and 17.0.1. No known workarounds are available as this does not require any permissions or other that can temporarily be disabled.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 19, 2026OpenProject is an open-source, web-based project management software.CVE-2026-23625 · Other software · opf · reported by GitHubHigh 8.7
OpenProject is an open-source, web-based project management software. Versions 16.3.0 through 16.6.4 are affected by a stored cross-site scripting vulnerability in the Roadmap view. OpenProject’s roadmap view renders the “Related work packages” list for each version. When a version contains work packages from a different project (e.g., a subproject), the helper link_to_work_package prepends package.project.to_s to the link and returns the entire string with .html_safe. Because project names are user-controlled and no escaping happens before calling html_safe, any HTML placed in a subproject name is injected verbatim into the page. The underlying issue is mitigated in versions 16.6.5 and 17.0.0 by setting a `X-Content-Type-Options: nosniff` header, which was in place until a refactoring move to Rails standard content-security policy, which did not properly apply this header in the new configuration since OpenProject 16.3.0. Those who cannot upgrade their installations should ensure that they add a X-Content-Type-Options: nosniff header in their proxying web application server.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2026ProjeQtOr Project Management 9.1.4 contains a file upload vulnerability that allows guest users to upload malicious PHP files with arbitrary code execution capaCVE-2021-47819 · Other software · Projeqtor · reported by VulnCheckCritical 9.3
ProjeQtOr Project Management 9.1.4 contains a file upload vulnerability that allows guest users to upload malicious PHP files with arbitrary code execution capabilities. Attackers can upload a PHP script through the profile attachment section and execute system commands by accessing the uploaded file with a specially crafted request parameter.
- Product
- ProjeQtOr Project Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordexploit-db.comprojeqtor.org
Jan 9, 2026OpenProject is an open-source, web-based project management software.CVE-2026-22605 · Other software · opf · reported by GitHubMedium 4.3
OpenProject is an open-source, web-based project management software. OpenProject versions prior to version 16.6.3, allowed users with the View Meetings permission on any project, to access meeting details of meetings that belonged to projects, the user does not have access to. This issue has been patched in version 16.6.3.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026OpenProject is an open-source, web-based project management software.CVE-2026-22604 · Other software · opf · reported by GitHubMedium 6.9
OpenProject is an open-source, web-based project management software. For OpenProject versions from 11.2.1 to before 16.6.2, when sending a POST request to the /account/change_password endpoint with an arbitrary User ID as the password_change_user_id parameter, the resulting error page would show the username for the requested user. Since this endpoint is intended to be called without being authenticated, this allows to enumerate the user names of all accounts registered in an OpenProject instance. This issue has been patched in version 16.6.2.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026OpenProject is an open-source, web-based project management software.CVE-2026-22603 · Other software · opf · reported by GitHubMedium 6.9
OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, OpenProject’s unauthenticated password-change endpoint (/account/change_password) was not protected by the same brute-force safeguards that apply to the normal login form. In affected versions, an attacker who can guess or enumerate user IDs can send unlimited password-change requests for a given account without triggering lockout or other rate-limiting controls. This allows automated password-guessing (e.g., with wordlists of common passwords) against valid accounts. Successful guessing results in full account compromise for the targeted user and, depending on that user’s role, can lead to further privilege escalation inside the application. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026OpenProject is an open-source, web-based project management software.CVE-2026-22602 · Other software · opf · reported by GitHubLow 3.5
OpenProject is an open-source, web-based project management software. Prior to version 16.6.2, a low‑privileged logged-in user can view the full names of other users. Since user IDs are assigned sequentially and predictably (e.g., 1 to 1000), an attacker can extract a complete list of all users’ full names by iterating through these URLs. The same behavior can also be reproduced via the OpenProject API, allowing automated retrieval of full names through the API as well. This issue has been patched in version 16.6.2. Those who are unable to upgrade may apply the patch manually.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026OpenProject is an open-source, web-based project management software.CVE-2026-22601 · Other software · opf · reported by GitHubHigh 8.6
OpenProject is an open-source, web-based project management software. For OpenProject version 16.6.1 and below, a registered administrator can execute arbitrary command by configuring sendmail binary path and sending a test email. This issue has been patched in version 16.6.2.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2026OpenProject is an open-source, web-based project management software.CVE-2026-22600 · Other software · opf · reported by GitHubCritical 9.1
OpenProject is an open-source, web-based project management software. A Local File Read (LFR) vulnerability exists in the work package PDF export functionality of OpenProject prior to version 16.6.4. By uploading a specially crafted SVG file (disguised as a PNG) as a work package attachment, an attacker can exploit the backend image processing engine (ImageMagick). When the work package is exported to PDF, the backend attempts to resize the image, triggering the ImageMagick text: coder. This allows an attacker to read arbitrary local files that the application user has permissions to access (e.g., /etc/passwd, all project configuration files, private project data, etc.). The attack requires permissions to upload attachments to a container that can be exported to PDF, such as a work package. The issue has been patched in version 16.6.4. Those who are unable to upgrade may apply the patch manually.
- Product
- openproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Kanboard is project management software focused on Kanban methodology.CVE-2026-21881 · Other software · kanboard · reported by GitHubCritical 9.1
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below is vulnerable to a critical authentication bypass when REVERSE_PROXY_AUTH is enabled. The application blindly trusts HTTP headers for user authentication without verifying the request originated from a trusted reverse proxy. An attacker can impersonate any user, including administrators, by simply sending a spoofed HTTP header. This issue is fixed in version 1.2.49.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Kanboard is project management software focused on Kanban methodology.CVE-2026-21880 · Other software · kanboard · reported by GitHubMedium 5.3
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below have an LDAP Injection vulnerability in the LDAP authentication mechanism. User-supplied input is directly substituted into LDAP search filters without proper sanitization, allowing attackers to enumerate all LDAP users, discover sensitive user attributes, and perform targeted attacks against specific accounts. This issue is fixed in version 1.2.49.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 7, 2026Kanboard is project management software focused on Kanban methodology.CVE-2026-21879 · Other software · kanboard · reported by GitHubMedium 4.7
Kanboard is project management software focused on Kanban methodology. Versions 1.2.48 and below are vulnerable to an Open Redirect attack that allows malicious actors to redirect authenticated users to attacker-controlled websites. By crafting URLs such as //evil.com, attackers can bypass the filter_var($url, FILTER_VALIDATE_URL) validation check. This vulnerability could be exploited to conduct phishing attacks, steal user credentials, or distribute malware. The issue is fixed in version 1.2.49.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2026Plane is an an open-source project management tool.CVE-2025-69284 · Other software · makeplane · reported by GitHubMedium 4.3
Plane is an an open-source project management tool. In plane.io, a guest user doesn't have a permission to access https[:]//app[.]plane[.]so/[:]slug/settings. Prior to Plane version 1.2.0, a problem occurs when the `/api/workspaces/:slug/members/` is accessible by guest and able to list of users on a specific workspace that they joined. Since the `display_name` in the response is actually the handler of the email, a malicious guest can still identify admin users' email addresses. Version 1.2.0 fixes this issue.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 5, 2025Projectopia – WordPress Project Management: Unauthorized modification of dataCVE-2025-12876 · WordPress plugins & themes · reported by WordfenceMedium 5.3
The Projectopia – WordPress Project Management plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pto_delete_file AJAX action in all versions up to, and including, 5.1.19. This makes it possible for unauthenticated attackers to delete arbitrary attachments.
- Product
- Projectopia – WordPress Project Management
- Affected
- up to 5.1.19
- What to do
- Affects up to 5.1.19. Update Projectopia – WordPress Project Management to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Nov 15, 2025Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager: Time-based SQL InjectionCVE-2025-8994 · WordPress plugins & themes · reported by WordfenceMedium 6.5
The Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager plugin for WordPress is vulnerable to time-based SQL Injection via the ‘completed_at_operator’ parameter in all versions up to, and including, 2.6.26 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Subscriber-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database.
- Product
- Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager
- Affected
- up to 2.6.26
- What to do
- Affects up to 2.6.26. Update Project Management, Team Collaboration, Kanban Board, Gantt Charts, Task Manager and More – WP Project Manager to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Oct 28, 2025Taiga is an open source project management platform.CVE-2025-62368 · Other software · taigaio · reported by GitHubCritical 9
Taiga is an open source project management platform. In versions 6.8.3 and earlier, a remote code execution vulnerability exists in the Taiga API due to unsafe deserialization of untrusted data. This issue is fixed in version 6.9.0.
- Product
- taiga-back
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 28, 2025Taiga is an open source project management platform.CVE-2025-62367 · Other software · taigaio · reported by GitHubMedium 4.8
Taiga is an open source project management platform. In versions 6.8.3 and earlier, Taiga API is vulnerable to time-based blind SQL injection allowing sensitive data disclosure via response timing. This issue is fixed in version 6.9.0.
- Product
- taiga-back
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2025Plane is open-source project management software.CVE-2025-62716 · Other software · makeplane · reported by GitHubHigh 8.1
Plane is open-source project management software. Prior to version 1.1.0, an open redirect vulnerability in the ?next_path query parameter allows attackers to supply arbitrary schemes (e.g., javascript:) that are passed directly to router.push. This results in a cross-site scripting (XSS) vulnerability, enabling attackers to execute arbitrary JavaScript in the victim’s browser. The issue can be exploited without authentication and has severe impact, including information disclosure, and privilege escalation and modifications of administrative settings. This issue has been patched in version 1.1.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2025Phproject is a high performance full-featured project management system.CVE-2025-57768 · Other software · Alanaktion · reported by GitHubMedium 6.9
Phproject is a high performance full-featured project management system. From 1.8.0 to before 1.8.3, a Stored Cross-Site Scripting (XSS) vulnerability exists in the Planned Hours field when creating a new project. When sending a POST request to /issues/new/, the value provided in the Planned Hours field is included in the server response without any HTML encoding or sanitization. Because of this, an attacker can craft a malicious payload such as <script>alert(1)</script> and include it in the planned_hours parameter. The server reflects the input directly in the HTML of the project creation page, causing the browser to interpret and execute it. This vulnerability is fixed in 1.8.3.
- Product
- phproject
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 15, 2025Plane is open-source project management software.CVE-2025-55203 · Other software · makeplane · reported by GitHubMedium 5.4
Plane is open-source project management software. Prior to version 0.28.0, a stored cross-site scripting (XSS) vulnerability exists in the description_html field of Plane. This flaw allows an attacker to inject malicious JavaScript code that is stored and later executed in other users’ browsers. The description_html field is not properly sanitized or escaped. An attacker can submit crafted JavaScript payloads that are saved in the application’s database. When another user views the affected content, the injected code executes in their browser, running in the application’s context and bypassing standard security protections. Successful exploitation can lead to session hijacking, theft of sensitive information, or forced redirection to malicious sites. The vulnerability can also be chained with CSRF attacks to perform unauthorized actions, or leveraged to distribute malware and exploit additional browser vulnerabilities. This issue has been patched in version 0.28.0.
- Product
- plane
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrive.google.comgithub.com
Aug 12, 2025Kanboard is project management software that focuses on the Kanban methodology.CVE-2025-55011 · Other software · kanboard · reported by GitHubMedium 6.4
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, the createTaskFile method in the API does not validate whether the task_id parameter is a valid task id, nor does it check for path traversal. As a result, a malicious actor could write a file anywhere on the system the app user controls. The impact is limited due to the filename being hashed and having no extension. This issue has been patched in version 1.2.47.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 12, 2025Kanboard is project management software that focuses on the Kanban methodology.CVE-2025-55010 · Other software · kanboard · reported by GitHubCritical 9.1
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.47, an unsafe deserialization vulnerability in the ProjectEventActvityFormatter allows admin users the ability to instantiate arbitrary php objects by modifying the event["data"] field in the project_activities table. A malicious actor can update this field to use a php gadget to write a web shell into the /plugins folder, which then gives remote code execution on the host system. This issue has been patched in version 1.2.47.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 31, 2025A stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4.CVE-2025-52203 · Other software · Devaslanphp · reported by MITREHigh 7.6
A stored cross-site scripting (XSS) vulnerability exists in DevaslanPHP project-management v1.2.4. The vulnerability resides in the Ticket Name field, which fails to properly sanitize user-supplied input. An authenticated attacker can inject malicious JavaScript payloads into this field, which are subsequently stored in the database. When a legitimate user logs in and is redirected to the Dashboard panel "automatically upon authentication the malicious script executes in the user's browser context.
- Product
- Project Management
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 25, 2025Kanboard is project management software that focuses on the Kanban methodology.CVE-2025-52576 · Other software · kanboard · reported by GitHubMedium 5.3
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard is vulnerable to username enumeration and IP spoofing-based brute-force protection bypass. By analyzing login behavior and abusing trusted HTTP headers, an attacker can determine valid usernames and circumvent rate-limiting or blocking mechanisms. Any organization running a publicly accessible Kanboard instance is affected, especially if relying on IP-based protections like Fail2Ban or CAPTCHA for login rate-limiting. Attackers with access to the login page can exploit this flaw to enumerate valid usernames and bypass IP-based blocking mechanisms, putting all user accounts at higher risk of brute-force or credential stuffing attacks. Version 1.2.46 contains a patch for the issue.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 23, 2025Kanboard is project management software that focuses on the Kanban methodology.CVE-2025-52560 · Other software · kanboard · reported by GitHubHigh 8.1
Kanboard is project management software that focuses on the Kanban methodology. Prior to version 1.2.46, Kanboard allows password reset emails to be sent with URLs derived from the unvalidated Host header when the application_url configuration is unset (default behavior). This allows an attacker to craft a malicious password reset link that leaks the token to an attacker-controlled domain. If a victim (including an administrator) clicks the poisoned link, their account can be taken over. This affects all users who initiate a password reset while application_url is not set. This issue has been patched in version 1.2.46.
- Product
- kanboard
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 20, 2025UpStream: a Project Management Plugin for: Missing AuthorizationCVE-2025-49974 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in upstreamplugin UpStream: a Project Management Plugin for WordPress upstream allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UpStream: a Project Management Plugin for WordPress: from n/a through <= 2.1.1.
- Product
- UpStream: a Project Management Plugin for
- Affected
- up to 2.1.1
- What to do
- Affects up to 2.1.1. Update UpStream: a Project Management Plugin for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.