Security Advisories
CVEs affecting projects tracked on Release Alert, from NVD & OSV.
CVE-2026-34717
9.9
CRITICALCVSS v3
Published
April 2, 2026
Affected
5 projects
Assigned by
GitHub
Severity scale
010
Description
OpenProject is an open-source, web-based project management software. Prior to version 17.2.3, the =n operator in modules/reporting/lib/report/operator.rb:177 embeds user input directly into SQL WHERE clauses without parameterization. This issue has been patched in version 17.2.3.
opf/openproject
GitHubOpenProject is the leading open source project management software for product, project and portfolio management. A powerful Jira alternative with agile planning, issue tracking, roadmaps, Gantt charts, time tracking, collaboration features, and more. Available on premises or in the cloud. ⭐Star us on GitHub
GitHubOpenProject is the leading open source project management software for product, project and portfolio management. A powerful Jira alternative with agile planning, issue tracking, roadmaps, Gantt charts, time tracking, collaboration features, and more. Available on premises or in the cloud. ⭐Star us on GitHub< 17.2.3NVD
openproject/openproject
Docker HubDocker image for OpenProject Community and Enterprise editions.
Docker HubDocker image for OpenProject Community and Enterprise editions.< 17.2.3NVD
Chocolatey