go-vikunja vikunja

• CVE-2026-123531 High 8.8 Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter –
• CVE-2026-123530 Medium 5.9 Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints –
• CVE-2026-123529 Medium 4.6 Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color –
• CVE-2026-123528 Medium 6.8 Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware –
• CVE-2026-123527 Medium 5.4 Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass –
• CVE-2026-123526 Medium 5.4 Vikunja before 2.7.1 Mass Assignment via Team external_id Field –
• CVE-2026-123525 Medium 6.5 Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations –
• CVE-2026-123524 Medium 5.7 Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload –
• CVE-2026-123523 Medium 6.5 Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache –
• CVE-2026-123522 High 7.1 Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook –
• CVE-2026-123521 Medium 5.9 Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint –
• CVE-2026-123520 High 7.1 Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion –
• CVE-2026-123519 Medium 6.5 Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports –
• CVE-2026-123518 Medium 4.3 Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move –
• CVE-2026-123517 Medium 4.3 Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint –
• CVE-2026-123516 Medium 4.3 Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import –
• CVE-2026-123515 Medium 4.1 Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Images –
• CVE-2026-123514 Medium 4.3 Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion –
• CVE-2026-123513 Medium 6.8 Vikunja before 2.7.1 Auth Token Leak via API URL Change –
• CVE-2026-123512 Medium 6.1 Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs –
• CVE-2026-123511 Medium 4.3 Vikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entries –
• CVE-2026-123510 Low 3.3 Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath –
• CVE-2026-123509 Medium 4.3 Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Count –
• CVE-2026-123508 Low 3.1 Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain –
• CVE-2026-123507 Low 2.7 Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter –
• CVE-2026-123506 Medium 5.4 Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints –
• CVE-2026-123505 Medium 5.5 Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database –
• CVE-2026-123504 Medium 4.3 Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members –
• CVE-2026-123503 Medium 5.4 Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion –
• CVE-2026-123502 Medium 5.2 Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logging –
• CVE-2026-123501 Medium 6.5 Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes –
• CVE-2026-123500 Medium 6.2 Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump –
• CVE-2026-123499 Medium 5.9 Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server –
• CVE-2026-123498 Low 3.7 Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata –
• CVE-2026-123497 Medium 6.8 Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery –
• CVE-2026-123496 Low 3.3 Vikunja veans before 2.7.1 Symlink Following in veans init –
• CVE-2026-123495 Medium 4.6 Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback –
• CVE-2026-123494 Low 3.5 Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks –
• CVE-2026-123493 Medium 5.4 Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens –
• CVE-2026-115507 Low 3.5 Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header 0.3%
• CVE-2026-111922 Medium 6.3 Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins 0.1%
• CVE-2026-111921 Medium 5.4 Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion 0.2%
• CVE-2026-111920 Medium 4.3 Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions 0.2%
• CVE-2026-111919 Medium 6.5 Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks 0.4%
• CVE-2026-111918 Medium 5.4 Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation 0.2%
• CVE-2026-111917 Medium 6.5 Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation 0.4%
• CVE-2026-62376 High 8.1 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access 0.3%
• CVE-2026-62367 High 7.5 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover <0.1%
• CVE-2026-57458 High 8.1 Vikunja: Scoped API token can mint unrestricted OAuth session credentials 0.3%
• CVE-2026-91985 High 7.5 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash 0.4%