Skip to content
Vikunja vulnerabilities
Newest
-
go-vikunja vikunja
Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds
CVE-2026-40103
Fix available
4.3 Medium
-
go-vikunja vikunja
Vikunja has a File Size Limit Bypass via Vikunja Import
CVE-2026-35602
Fix available
5.4 Medium
-
go-vikunja vikunja
Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output
CVE-2026-35601
Fix available
4.1 Medium
-
go-vikunja vikunja
Vikunja has HTML Injection via Task Titles in Overdue Email Notifications
CVE-2026-35600
Fix available
5.4 Medium
-
go-vikunja vikunja
Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler
CVE-2026-35599
Fix available
6.5 Medium
-
go-vikunja vikunja
Vikunja has Missing Authorization on CalDAV Task Read
CVE-2026-35598
Fix available
4.3 Medium
-
go-vikunja vikunja
Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout
CVE-2026-35597
Fix available
5.9 Medium
-
go-vikunja vikunja
Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug
CVE-2026-35596
Fix available
4.3 Medium
-
go-vikunja vikunja
Vikunja Affected by Privilege Escalation via Project Reparenting
CVE-2026-35595
Fix available
8.3 High
-
go-vikunja vikunja
Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade
CVE-2026-35594
Fix available
6.5 Medium
-
go-vikunja vikunja
Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path
CVE-2026-34727
Fix available
7.4 High
-
go-vikunja vikunja
Vikunja - Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDOR
CVE-2026-56765
Fix available
9.3 Critical
-
go-vikunja vikunja
Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion
CVE-2026-33700
Fix available
6.9 Medium
-
go-vikunja vikunja
Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation
CVE-2026-33680
Fix available
7.5 High
-
go-vikunja vikunja
Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections
CVE-2026-33679
Fix available
6.4 Medium
-
go-vikunja vikunja
Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion
CVE-2026-33678
Fix available
8.1 High
-
go-vikunja vikunja
Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API
CVE-2026-33677
Fix available
6.5 Medium
-
go-vikunja vikunja
Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read
CVE-2026-33676
Fix available
6.5 Medium
-
go-vikunja vikunja
Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources
CVE-2026-33675
Fix available
6.4 Medium
-
go-vikunja vikunja
Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect
CVE-2026-33668
Fix available
7.1 High
-
go-vikunja vikunja
Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation
CVE-2026-33336
6.5 Medium
-
go-vikunja vikunja
Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal
CVE-2026-33335
6.4 Medium
-
go-vikunja vikunja
Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration
CVE-2026-33334
6.5 Medium
-
go-vikunja vikunja
Vikunja Affected by DoS via Image Preview Generation
CVE-2026-33474
Fix available
6.5 Medium
-
go-vikunja vikunja
Vikunja has TOTP Reuse During Validity Window
CVE-2026-33473
Fix available
5.7 Medium
-
go-vikunja vikunja
Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement
CVE-2026-33316
8.1 High
-
go-vikunja vikunja
Vikunja has a 2FA Bypass via Caldav Basic Auth
CVE-2026-33315
6.9 Medium
-
go-vikunja vikunja
Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments
CVE-2026-33313
5.3 Medium
-
go-vikunja vikunja
Read-only Vikunja users can delete project background images via broken object-level authorization
CVE-2026-33312
Fix available
5.3 Medium
-
go-vikunja vikunja
Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers
CVE-2026-29794
Fix available
5.3 Medium
-
go-vikunja vikunja
Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
CVE-2026-28268
9.8 Critical
-
go-vikunja vikunja
Vikunja has Path Traversal in CLI Restore
CVE-2026-27819
7.2 High
-
go-vikunja vikunja
Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure
CVE-2026-27616
7.3 High
-
go-vikunja vikunja
Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
CVE-2026-27575
9.1 Critical
-
go-vikunja vikunja
Vikunja has Reflected HTML Injection via filter Parameter in Projects Module
CVE-2026-27116
6.1 Medium
-
go-vikunja vikunja
Vikunja Affected by XSS Via Task Preview
CVE-2026-25935
8.6 High