CVEs published in November 2026
7,953 vulnerabilities, 680 critical, 12 exploited.
- go-vikunja vikunjaVikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints6.0 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color5.1 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware7.6 High
- go-vikunja vikunjaVikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass5.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Mass Assignment via Team external_id Field5.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations7.1 High
- go-vikunja vikunjaVikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload6.9 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache7.1 High
- go-vikunja vikunjaVikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook7.1 High
- go-vikunja vikunjaVikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint6.0 Medium
- go-vikunja vikunjaVikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion7.1 High
- go-vikunja vikunjaVikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports7.1 High
- go-vikunja vikunjaVikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move5.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint7.1 High
- go-vikunja vikunjaVikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import7.1 High
- go-vikunja vikunjaVikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Images5.1 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion5.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Auth Token Leak via API URL Change7.6 High
- go-vikunja vikunjaVikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs8.4 High
- go-vikunja vikunjaVikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entries5.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath1.0 Low
- go-vikunja vikunjaVikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Count5.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain2.0 Low
- go-vikunja vikunjaVikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter5.1 Medium
- go-vikunja vikunjaVikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints5.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 World-Readable Local File Storage and SQLite Database6.8 Medium
- go-vikunja vikunjaVikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members5.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion5.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logging6.9 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes7.1 High
- go-vikunja vikunjaVikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump6.9 Medium
- go-vikunja vikunjaVikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server6.0 Medium
- go-vikunja vikunjaVikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata2.1 Low
- go-vikunja vikunjaVikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery7.6 High
- go-vikunja vikunjaVikunja veans before 2.7.1 Symlink Following in veans init4.8 Medium
- go-vikunja vikunjaVikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback5.1 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks5.1 Medium
- go-vikunja vikunjaVikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens5.3 Medium
htslibOSS-FuzzHeap-buffer-overflow in cram_encode_containerNo scoretarantoolOSS-FuzzHeap-use-after-free in lj_cconv_ct_ctNo scoreperl-Mail-SendmailopenSUSEperl-Mail-Sendmail-0.830.0-1.1 on GA mediaNo score- wedevs subscribe2 – form, email subscribers & newslettersSubscribe2 – Form, Email Subscribers & Newsletters <= 10.47 - Unauthenticated Stored Cross-Site Scripting via 'data[ip]' Parameter7.2 High
nfs-ganeshaDebian[Unknown description]No score- totolink ca300-poeTOTOLINK CA300-PoE cstecgi.cgi UploadCustomModule buffer overflow9.4 Critical
- linuxnetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packetsNo score
- totolink ca300-poeTOTOLINK CA300-PoE cstecgi.cgi setWiFiWdsAddConfig buffer overflow9.4 Critical
- totolink ca300-poeTOTOLINK CA300-PoE cstecgi.cgi setWiFiRepeaterConfig buffer overflow9.4 Critical
- totolink ca300-poeTOTOLINK CA300-PoE cstecgi.cgi setWiFiMultipleConfig buffer overflow9.4 Critical
- elightup meta box – wordpress custom fields frameworkWordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.3 - Cross Site Scripting (XSS) vulnerability6.5 Medium
- themegrill user registrationWordPress User Registration plugin <= 5.3.1 - Broken Access Control vulnerability5.3 Medium
- Show moreLoading…