KKanboard

Products

Exploited and recent CVEs

• CVE-2026-57862 High 8.5 Kanboard 1.2.52 and prior SSRF Filter Bypass via Hexadecimal IP Notation 0.4%
• CVE-2026-58660 High 8.1 Kanboard BoardAjaxController Missing Ownership Check via Drag-and-Drop 0.5%
• CVE-2026-56774 Medium 5.4 Kanboard - Cross-User Deletion of Persistent Login Sessions via Unvalidated Session ID 0.5%
• CVE-2026-33058 High 8.4 Kanboard has Authenticated SQL Injection in Project Permissions Handler 0.3%
• CVE-2026-29056 High 7.0 Kanboard's privilege escalation via mass assignment in user invite registration allows any invited user to become admin 0.4%
• CVE-2026-25531 Medium 4.3 Kanboard TaskCreationController::duplicateProjects() endpoint does not validate user permissions for target projects 0.3%
• CVE-2026-25924 High 8.5 Kanboard is Missing Access Control on Plugin Installation leading to Administrative RCE 0.6%
• CVE-2026-25530 Medium 4.3 Kanboard is missing authorization check in getSwimlane API allows cross-project data access 0.3%
• CVE-2026-24885 Medium 5.7 Kanboard Affected by Cross-Site Request Forgery (CSRF) via Content-Type Misconfiguration in Project Role Assignment 0.2%
• CVE-2026-21881 Critical 9.1 Kanboard is Vulnerable to Reverse Proxy Authentication Bypass 0.5%
• CVE-2026-21880 Medium 5.3 Kanboard LDAP Injection Vulnerability can Lead to User Enumeration and Information Disclosure 0.4%
• CVE-2026-21879 Medium 4.7 Kanboard vulnerable to Open Redirect via protocol-relative URLs 0.3%
• CVE-2025-55010 Critical 9.1 Kanboard Authenticated Admin Remote Code Execution via Unsafe Deserialization of Events 1.0%
• CVE-2025-55011 Medium 6.4 Kanboard Path Traversal in File Write via Task File Upload Api 0.4%
• CVE-2025-52576 Medium 5.3 Kanboard vulnerable to Username Enumeration via Login Behavior and Bruteforce Protection Bypass 0.4%
• CVE-2025-52560 High 8.1 Kanboard Password Reset Poisoning via Host Header Injection 0.5%
• CVE-2025-46825 Low 1.3 Kanboard has stored Cross-site Scripting vulnerability in project name 0.4%
• CVE-2024-55603 Medium 6.5 Insufficient session invalidation in Kanboard 0.5%
• CVE-2024-54001 Medium 5.5 Kanboard allows a persistent HTML injection site scripting in settings page date format 0.4%
• CVE-2024-51747 Critical 9.1 Arbitrary File Read and Delete in kanboard 0.8%
• CVE-2024-51748 Critical 9.1 Remote code execution through language setting in kanboard 0.9%
• CVE-2024-36399 High 8.2 Kanboard affected by Project Takeover via IDOR in ProjectPermissionController 0.4%
• CVE-2023-36813 High 7.1 Kanboard Authenticated SQL Injections vulnerability 0.9%
• CVE-2023-33969 Medium 6.4 Stored Cross site scripting in the Task External Link Functionality in Kanboard 0.5%
• CVE-2023-33970 Medium 5.4 Missing access control in internal task links feature in Kanboard 0.5%
• CVE-2023-33968 Medium 5.4 Missing Access Control allows User to move and duplicate tasks in Kanboard 0.4%
• CVE-2023-33956 Medium 4.3 Parameter based Indirect Object Referencing leading to private file exposure in Kanboard 0.6%
• CVE-2023-32685 Medium 4.4 Clipboard based cross-site scripting (blocked with default CSP) in Kanboard 0.5%