go-vikunja vikunja

• CVE-2026-115507 Low 3.5 Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header 0.3%
• CVE-2026-111922 Medium 6.3 Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins 0.1%
• CVE-2026-111921 Medium 5.4 Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion 0.2%
• CVE-2026-111920 Medium 4.3 Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions 0.2%
• CVE-2026-111919 Medium 6.5 Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks 0.4%
• CVE-2026-111918 Medium 5.4 Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation 0.2%
• CVE-2026-111917 Medium 6.5 Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation 0.4%
• CVE-2026-62376 High 8.1 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access 0.3%
• CVE-2026-62367 High 7.5 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover <0.1%
• CVE-2026-57458 High 8.1 Vikunja: Scoped API token can mint unrestricted OAuth session credentials 0.3%
• CVE-2026-91985 High 7.5 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash 0.4%
• CVE-2026-91984 Medium 4.3 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position 0.3%
• CVE-2026-91983 Medium 4.3 Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter 0.3%
• CVE-2026-91982 Medium 4.3 Vikunja before 2.6.0 TOTP Secret Disclosure via API 0.3%
• CVE-2026-91981 Medium 4.3 Vikunja before 2.6.0 User Enumeration via v2 API 0.3%
• CVE-2026-91980 Medium 4.3 vikunja before 2.6.0 Team Enumeration via Project Share 0.3%
• CVE-2026-91979 Medium 6.5 Vikunja before 2.6.0 Denial of Service via Decompression Bomb 0.4%
• CVE-2026-91973 High 7.5 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth 0.7%
• CVE-2026-91972 High 7.5 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API 0.6%
• CVE-2026-91971 Medium 6.5 Vikunja before 2.6.0 Denial of Service via Avatar Upload 0.4%
• CVE-2026-91970 Medium 6.5 Vikunja before 2.6.0 Resource Exhaustion via Planka Migration 0.4%
• CVE-2026-91969 Medium 6.5 vikunja before 2.6.0 Resource Exhaustion via CSV Migration 0.4%
• CVE-2026-91968 Medium 6.5 vikunja before 2.6.0 Denial of Service via unbounded filter recursion 0.4%
• CVE-2026-55067 Medium 5.0 Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment 0.3%
• CVE-2026-55066 High 7.1 Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id 0.4%
• CVE-2026-55065 High 8.1 Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api 0.5%
• CVE-2026-55064 Medium 4.3 Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 0.4%
• CVE-2026-54766 Medium 5.3 Vikunja: Project duplication bypasses write-permission check on the target parent project 0.4%
• CVE-2026-76216 High 7.5 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing 0.4%
• CVE-2026-68582 Medium 6.5 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token 0.3%
• CVE-2026-68581 High 8.1 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision 0.5%
• CVE-2026-40103 Medium 4.3 Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds 0.2%
• CVE-2026-35602 Medium 5.4 Vikunja has a File Size Limit Bypass via Vikunja Import 0.3%
• CVE-2026-35601 Medium 4.1 Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output 0.2%
• CVE-2026-35600 Medium 5.4 Vikunja has HTML Injection via Task Titles in Overdue Email Notifications 0.2%
• CVE-2026-35599 Medium 6.5 Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler 0.3%
• CVE-2026-35598 Medium 4.3 Vikunja has Missing Authorization on CalDAV Task Read 0.2%
• CVE-2026-35597 Medium 5.9 Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout 0.3%
• CVE-2026-35596 Medium 4.3 Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug 0.3%
• CVE-2026-35595 High 8.3 Vikunja Affected by Privilege Escalation via Project Reparenting 0.3%
• CVE-2026-35594 Medium 6.5 Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade 0.3%
• CVE-2026-34727 High 7.4 Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path 0.3%
• CVE-2026-33700 Medium 6.9 Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion 0.3%
• CVE-2026-33680 High 7.5 Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation 0.4%
• CVE-2026-33679 Medium 6.4 Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections 0.4%
• CVE-2026-33678 High 8.1 Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion 0.3%
• CVE-2026-33677 Medium 6.5 Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API 0.3%
• CVE-2026-33676 Medium 6.5 Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read 0.4%
• CVE-2026-33675 Medium 6.4 Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources 0.3%
• CVE-2026-33668 High 7.1 Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect 0.5%