Go-vikunja vulnerabilities

Products

• Vikunja 67

Newest

• go-vikunja vikunja Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter CVE-2026-123531 8.7 HighNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints CVE-2026-123530 6.0 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color CVE-2026-123529 5.1 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware CVE-2026-123528 7.6 HighNovember 8, 2026
• go-vikunja vikunja Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass CVE-2026-123527 5.3 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Mass Assignment via Team external_id Field CVE-2026-123526 5.3 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations CVE-2026-123525 7.1 HighNovember 8, 2026
• go-vikunja vikunja Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload CVE-2026-123524 6.9 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache CVE-2026-123523 7.1 HighNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook CVE-2026-123522 7.1 HighNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint CVE-2026-123521 6.0 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion CVE-2026-123520 7.1 HighNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports CVE-2026-123519 7.1 HighNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move CVE-2026-123518 5.3 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint CVE-2026-123517 7.1 HighNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import CVE-2026-123516 7.1 HighNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Images CVE-2026-123515 5.1 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion CVE-2026-123514 5.3 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Auth Token Leak via API URL Change CVE-2026-123513 7.6 HighNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs CVE-2026-123512 8.4 HighNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entries CVE-2026-123511 5.3 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath CVE-2026-123510 1.0 LowNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Count CVE-2026-123509 5.3 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain CVE-2026-123508 2.0 LowNovember 8, 2026
• go-vikunja vikunja Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter CVE-2026-123507 5.1 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints CVE-2026-123506 5.3 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database CVE-2026-123505 6.8 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members CVE-2026-123504 5.3 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion CVE-2026-123503 5.3 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logging CVE-2026-123502 6.9 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes CVE-2026-123501 7.1 HighNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump CVE-2026-123500 6.9 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server CVE-2026-123499 6.0 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata CVE-2026-123498 2.1 LowNovember 8, 2026
• go-vikunja vikunja Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery CVE-2026-123497 7.6 HighNovember 8, 2026
• go-vikunja vikunja Vikunja veans before 2.7.1 Symlink Following in veans init CVE-2026-123496 4.8 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback CVE-2026-123495 5.1 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks CVE-2026-123494 5.1 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens CVE-2026-123493 5.3 MediumNovember 8, 2026
• go-vikunja vikunja Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header CVE-2026-115507 5.1 MediumOctober 22, 2026
• go-vikunja vikunja Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins CVE-2026-111922 7.2 HighOctober 9, 2026
• go-vikunja vikunja Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion CVE-2026-111921 Fix available 5.3 MediumOctober 9, 2026
• go-vikunja vikunja Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions CVE-2026-111920 Fix available 5.3 MediumOctober 9, 2026
• go-vikunja vikunja Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks CVE-2026-111919 7.1 HighOctober 9, 2026
• go-vikunja vikunja Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation CVE-2026-111918 Fix available 5.3 MediumOctober 9, 2026
• go-vikunja vikunja Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation CVE-2026-111917 Fix available 7.1 HighOctober 9, 2026
• go-vikunja vikunja Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access CVE-2026-62376 Fix available 8.1 HighOctober 9, 2026
• go-vikunja vikunja Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover CVE-2026-62367 Fix available 7.5 HighOctober 9, 2026
• go-vikunja vikunja Vikunja: Scoped API token can mint unrestricted OAuth session credentials CVE-2026-57458 Fix available 8.1 HighOctober 9, 2026
• go-vikunja vikunja Vikunja before 2.6.0 Privilege Escalation via Link Share Hash CVE-2026-91985 Fix available 8.7 HighSeptember 15, 2026
• Show olderLoading…