Log in Start free

WeKan

Products

ProductCVEsExploitedLatest
WeKan36–Oct 30, 2026

Exploited and recent CVEs

  • CVE-2026-119300 Medium 6.5 Wekan: ReDoS via Unescaped User Input in RegExp 0.3%
  • CVE-2026-68901 Medium 6.5 WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service 0.5%
  • CVE-2026-68900 High 7.6 Wekan: Stored XSS in HTML board exports through a card-title second parse 0.4%
  • CVE-2026-68899 High 8.7 Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback 0.5%
  • CVE-2026-68561 High 8.8 Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule 0.5%
  • CVE-2026-68560 High 7.7 Wekan:hell Injection in External Antivirus Scanner Path via asyncExec 0.6%
  • CVE-2026-68558 High 8.5 Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446) 0.4%
  • CVE-2026-68559 Medium 6.5 Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`) 0.4%
  • CVE-2026-55652 Critical 9.8 Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin) 0.6%
  • CVE-2026-55234 High 8.5 Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule) 0.4%
  • CVE-2026-53447 Medium 6.5 Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID 0.4%
  • CVE-2026-52893 Critical 9.2 Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook 0.5%
  • CVE-2026-53444 High 7.6 Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin 0.4%
  • CVE-2026-53445 High 7.1 Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards 0.4%
  • CVE-2026-53446 Medium 6.2 Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLs 0.5%
  • CVE-2026-52892 Medium 6.5 Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops) 0.5%
  • CVE-2026-52891 Critical 9.9 Wekan: Shell Injection via Avatar Upload 0.8%
  • CVE-2026-52890 High 7.1 Wekan: Arbitrary file read and server DoS via attachment versions.original.path 0.5%
  • CVE-2026-59154 Medium 4.3 Wekan: Checklist direct DDP updates can write checklist data into private boards 0.4%
  • CVE-2026-41455 High 8.5 WeKan < 8.35 SSRF via Webhook URL 0.2%
  • CVE-2026-41454 High 8.3 WeKan < 8.35 Missing Authorization via Integration REST API 0.3%
  • CVE-2026-30847 Critical 9.3 Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens 0.3%
  • CVE-2026-30846 High 8.7 Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication 0.4%
  • CVE-2026-30845 Medium 6.9 Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication 0.3%
  • CVE-2026-30844 Critical 9.3 Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading 0.3%
  • CVE-2026-30843 Critical 9.3 Wekan has Cross-Board IDOR in Custom Fields Update Endpoints 0.2%
  • CVE-2026-25859 High 7.1 WeKan < 8.20 Migration Functionality Insufficient Permission Checks 0.4%
  • CVE-2026-25568 High 7.1 WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass 0.2%
  • CVE-2026-25567 Medium 5.3 WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId 0.3%
  • CVE-2026-25566 High 7.1 WeKan < 8.19 Cross-board Card Move Without Destination Authorization 0.2%