Threat Intelligence Database
Comprehensive database of the latest cyber threats affecting organizations worldwide. Filter and search to find specific threat intelligence relevant to your organization.
Stop chasing alerts. Route them.
Start free, then upgrade once to turn Radar into an automated delivery engine for your security stack.
Custom feeds / Automations: email, Slack, webhooks, SIEM/MISP / API access (baseline limits)
API access activates after upgrading in Console -> Billing.
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.
Filter Threats
Narrow down the results by type, severity, or affected countries
Threat Intelligence
Click on any threat for detailed analysis and mitigation recommendations
CVE-2026-67529: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor in opf openprojectCVE-2026-67529 0 OpenProject versions prior to 17.6.0 have a vulnerability where certain API endpoints expose private work package titles and IDs to users who have permission to view time or cost entries but not the work packages themselves. This occurs because the API renders work package links without verifying if the user has visibility permissions. The issue is fixed in version 17.6.0. Join the discussion | CVE Database V5 | 07/30/2026, 19:29:24 UTC Added: 07/30/2026, 20:07:41 UTC |
CVE-2026-67528: CWE-863: Incorrect Authorization in opf openprojectCVE-2026-67528 0 OpenProject versions prior to 17.6.0 contain an authorization flaw where authenticated non-admin users can enumerate sequential custom option IDs and access labels of admin-only user or group custom fields. This issue is resolved in version 17.6.0. Join the discussion | CVE Database V5 | 07/30/2026, 19:24:09 UTC Added: 07/30/2026, 19:38:43 UTC |
CVE-2026-67527: CWE-862: Missing Authorization in opf openprojectCVE-2026-67527 0 OpenProject versions prior to 17.6.0 contain a missing authorization vulnerability in the PATCH /api/v3/work_packages/{id} endpoint. Authenticated users with edit_work_packages permission but without manage_file_links permission could manipulate file link records by raw ID, including detaching, hard-deleting, or re-parenting FileLinks to attacker-controlled work packages. This exposed metadata such as origin filename, origin ID, and MIME type. The issue is fixed in version 17.6.0. Join the discussion | CVE Database V5 | 07/30/2026, 19:19:25 UTC Added: 07/30/2026, 19:38:43 UTC |
Showing 1 to 3 of 3 results