Skip to contentGo-vikunja Vikunja vulnerabilities
- go-vikunja vikunjaVikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 ParameterCVE-2026-1235318.7 High
- go-vikunja vikunjaVikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment EndpointsCVE-2026-1235306.0 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-colorCVE-2026-1235295.1 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Insufficient Session Expiration via HTTP Token MiddlewareCVE-2026-1235287.6 High
- go-vikunja vikunjaVikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization BypassCVE-2026-1235275.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Mass Assignment via Team external_id FieldCVE-2026-1235265.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do MigrationsCVE-2026-1235257.1 High
- go-vikunja vikunjaVikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks PayloadCVE-2026-1235246.9 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size CacheCVE-2026-1235237.1 High
- go-vikunja vikunjaVikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move WebhookCVE-2026-1235227.1 High
- go-vikunja vikunjaVikunja before 2.7.1 Password Brute-Force via TOTP Disable EndpointCVE-2026-1235216.0 Medium
- go-vikunja vikunjaVikunja 0.18.0 before 2.7.1 Privilege Escalation via Account DeletionCVE-2026-1235207.1 High
- go-vikunja vikunjaVikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File ImportsCVE-2026-1235197.1 High
- go-vikunja vikunjaVikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket MoveCVE-2026-1235185.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Information Disclosure via Team Self-Removal EndpointCVE-2026-1235177.1 High
- go-vikunja vikunjaVikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP ImportCVE-2026-1235167.1 High
- go-vikunja vikunjaVikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text ImagesCVE-2026-1235155.1 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Orphaned Export Archives Enable Disk ExhaustionCVE-2026-1235145.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Auth Token Leak via API URL ChangeCVE-2026-1235137.6 High
- go-vikunja vikunjaVikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access LogsCVE-2026-1235128.4 High
- go-vikunja vikunjaVikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO EntriesCVE-2026-1235115.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Plugin and Log Directories Not Anchored to RootpathCVE-2026-1235101.0 Low
- go-vikunja vikunjaVikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket CountCVE-2026-1235095.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release ToolchainCVE-2026-1235082.0 Low
- go-vikunja vikunjaVikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket FilterCVE-2026-1235075.1 Medium
- go-vikunja vikunjaVikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook EndpointsCVE-2026-1235065.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 World-Readable Local File Storage and SQLite DatabaseCVE-2026-1235056.8 Medium
- go-vikunja vikunjaVikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only MembersCVE-2026-1235045.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Improper Authorization in Kanban Bucket DeletionCVE-2026-1235035.3 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Link-Share Hash Exposure via Request Path LoggingCVE-2026-1235026.9 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image DecodesCVE-2026-1235017.1 High
- go-vikunja vikunjaVikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dumpCVE-2026-1235006.9 Medium
- go-vikunja vikunjaVikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml ServerCVE-2026-1234996.0 Medium
- go-vikunja vikunjaVikunja veans before 2.7.1 Prompt Injection via Project and Task MetadataCVE-2026-1234982.1 Low
- go-vikunja vikunjaVikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server DiscoveryCVE-2026-1234977.6 High
- go-vikunja vikunjaVikunja veans before 2.7.1 Symlink Following in veans initCVE-2026-1234964.8 Medium
- go-vikunja vikunjaVikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC CallbackCVE-2026-1234955.1 Medium
- go-vikunja vikunjaVikunja before 2.7.1 Login CSRF via Migration OAuth CallbacksCVE-2026-1234945.1 Medium
- go-vikunja vikunjaVikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API TokensCVE-2026-1234935.3 Medium
- go-vikunja vikunjaVikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email HeaderCVE-2026-1155075.1 Medium
- go-vikunja vikunjaVikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost OriginsCVE-2026-1119227.2 High
- go-vikunja vikunjaVikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share DeletionCVE-2026-111921Fix available5.3 Medium
- go-vikunja vikunjaVikunja 2.6.0 Broken Access Control via Inherited Project PermissionsCVE-2026-111920Fix available5.3 Medium
- go-vikunja vikunjaVikunja 0.22.0 before 2.7.0 Improper Access Revocation via WebhooksCVE-2026-1119197.1 High
- go-vikunja vikunjaVikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter CreationCVE-2026-111918Fix available5.3 Medium
- go-vikunja vikunjaVikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session RevocationCVE-2026-111917Fix available7.1 High
- go-vikunja vikunjaVikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read accessCVE-2026-62376Fix available8.1 High
- go-vikunja vikunjaVikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeoverCVE-2026-62367Public exploitFix available7.5 High
- go-vikunja vikunjaVikunja: Scoped API token can mint unrestricted OAuth session credentialsCVE-2026-57458Fix available8.1 High
- go-vikunja vikunjaVikunja before 2.6.0 Privilege Escalation via Link Share HashCVE-2026-91985Fix available8.7 High
- Show olderLoading…