CVE-2026-25764

OpenProject is an open-source, web-based project management software. Prior to versions 16.6.7 and 17.0.3, an HTML injection vulnerability occurs in the time tracking function of OpenProject. The application does not escape HTML tags, an attacker with administrator privileges can create a work package with the name containing the HTML tags and add it to the Work package section when creating time tracking. This issue has been patched in versions 16.6.7 and 17.0.3.

• CWE-80

• https://github.com/opf/openproject/releases/tag/v16.6.7Product, Release Notes
• https://github.com/opf/openproject/releases/tag/v17.0.3Product, Release Notes
• https://github.com/opf/openproject/security/advisories/GHSA-q523-c695-h3hpVendor Advisory

Published

Feb 6, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-25759Statmatic is a Laravel and Git powered content management sy…8.7
• CVE-2026-2576The Business Directory Plugin – Easy Listing Directories for…7.5
• CVE-2026-25760Sliver is a command and control framework that uses a custom…6.5
• CVE-2026-25761Super-linter is a combination of multiple linters to run as …8.8
• CVE-2026-25762AdonisJS is a TypeScript-first web framework. Prior to versi…7.5
• CVE-2026-25763OpenProject is an open-source, web-based project management …9.9
• CVE-2026-25765Faraday is an HTTP client library abstraction layer that pro…5.8
• CVE-2026-25766Echo is a Go web framework. In versions 5.0.0 through 5.0.2 …5.3
• CVE-2026-25767LavinMQ is a high-performance message queue & streaming serv…8.1
• CVE-2026-25768LavinMQ is a high-performance message queue & streaming serv…6.5
• CVE-2026-25769Wazuh is a free and open source platform used for threat pre…9.1
• CVE-2026-2577The WhatsApp bridge component in Nanobot binds the WebSocket…10