CVE-2026-27733 Medium 4.3

Authorization bypass via MCP endpoint

CVE-2026-27716 Medium 4.3

Information disclosure on OpenProject through /api/v3/custom_fields/{id}/items

CVE-2026-26968 Medium 4.3

Improper Access Control on OpenProject instance through /api/v3/capabilities

CVE-2026-24775 High 8.9

Forced Actions, Content Spoofing, and Persistent DoS via ID Manipulation in OpenProject Blocknote Editor Extension

CVE-2026-24772 Medium 6.3

SSRF and CSWSH in Hocuspocus Synchronization Server

CVE-2026-23646 Medium 6.5

Users can delete other user's session, causing them to be logged out

CVE-2026-22600 Critical 9.1

Arbitrary File Read via ImageMagick SVG Coder