Log in Start free

go-vikunja

Products

ProductCVEsExploitedLatest
vikunja66–Oct 22, 2026

Exploited and recent CVEs

  • CVE-2026-115507 Low 3.5 Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header 0.3%
  • CVE-2026-111922 Medium 6.3 Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins 0.1%
  • CVE-2026-111921 Medium 5.4 Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion 0.2%
  • CVE-2026-111920 Medium 4.3 Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions 0.2%
  • CVE-2026-111919 Medium 6.5 Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks 0.4%
  • CVE-2026-111918 Medium 5.4 Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation 0.2%
  • CVE-2026-111917 Medium 6.5 Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation 0.4%
  • CVE-2026-62376 High 8.1 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access 0.3%
  • CVE-2026-62367 High 7.5 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover <0.1%
  • CVE-2026-57458 High 8.1 Vikunja: Scoped API token can mint unrestricted OAuth session credentials 0.3%
  • CVE-2026-91985 High 7.5 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash 0.4%
  • CVE-2026-91984 Medium 4.3 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position 0.3%
  • CVE-2026-91983 Medium 4.3 Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter 0.3%
  • CVE-2026-91982 Medium 4.3 Vikunja before 2.6.0 TOTP Secret Disclosure via API 0.3%
  • CVE-2026-91981 Medium 4.3 Vikunja before 2.6.0 User Enumeration via v2 API 0.3%
  • CVE-2026-91980 Medium 4.3 vikunja before 2.6.0 Team Enumeration via Project Share 0.3%
  • CVE-2026-91979 Medium 6.5 Vikunja before 2.6.0 Denial of Service via Decompression Bomb 0.4%
  • CVE-2026-91973 High 7.5 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth 0.7%
  • CVE-2026-91972 High 7.5 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API 0.6%
  • CVE-2026-91971 Medium 6.5 Vikunja before 2.6.0 Denial of Service via Avatar Upload 0.4%
  • CVE-2026-91970 Medium 6.5 Vikunja before 2.6.0 Resource Exhaustion via Planka Migration 0.4%
  • CVE-2026-91969 Medium 6.5 vikunja before 2.6.0 Resource Exhaustion via CSV Migration 0.4%
  • CVE-2026-91968 Medium 6.5 vikunja before 2.6.0 Denial of Service via unbounded filter recursion 0.4%
  • CVE-2026-55067 Medium 5.0 Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment 0.3%
  • CVE-2026-55066 High 7.1 Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id 0.4%
  • CVE-2026-55065 High 8.1 Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api 0.5%
  • CVE-2026-55064 Medium 4.3 Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 0.4%
  • CVE-2026-54766 Medium 5.3 Vikunja: Project duplication bypasses write-permission check on the target parent project 0.4%
  • CVE-2026-76216 High 7.5 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing 0.4%
  • CVE-2026-68582 Medium 6.5 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token 0.3%