Skip to content
Wekan vulnerabilities
Newest
-
wekan
Wekan: ReDoS via Unescaped User Input in RegExp
CVE-2026-119300
6.5 Medium
-
wekan
WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service
CVE-2026-68901
6.5 Medium
-
wekan
Wekan: Stored XSS in HTML board exports through a card-title second parse
CVE-2026-68900
7.6 High
-
wekan
Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback
CVE-2026-68899
8.7 High
-
wekan
Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule
CVE-2026-68561
8.8 High
-
wekan
Wekan:hell Injection in External Antivirus Scanner Path via asyncExec
CVE-2026-68560
7.7 High
-
wekan
Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)
CVE-2026-68558
8.5 High
-
wekan
Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)
CVE-2026-68559
6.5 Medium
-
wekan
Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)
CVE-2026-55652
9.8 Critical
-
wekan
Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)
CVE-2026-55234
8.5 High
-
wekan
Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID
CVE-2026-53447
6.5 Medium
-
wekan
Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook
CVE-2026-52893
9.2 Critical
-
wekan
Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin
CVE-2026-53444
7.6 High
-
wekan
Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards
CVE-2026-53445
7.1 High
-
wekan
Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLs
CVE-2026-53446
6.2 Medium
-
wekan
Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)
CVE-2026-52892
6.5 Medium
-
wekan
Wekan: Shell Injection via Avatar Upload
CVE-2026-52891
9.9 Critical
-
wekan
Wekan: Arbitrary file read and server DoS via attachment versions.original.path
CVE-2026-52890
7.1 High
-
wekan
Wekan: Checklist direct DDP updates can write checklist data into private boards
CVE-2026-59154
4.3 Medium
-
wekan
WeKan < 8.35 SSRF via Webhook URL
CVE-2026-41455
6.3 Medium
-
wekan
WeKan < 8.35 Missing Authorization via Integration REST API
CVE-2026-41454
8.7 High
-
wekan
Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens
CVE-2026-30847
9.3 Critical
-
wekan
Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication
CVE-2026-30846
8.7 High
-
wekan
Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication
CVE-2026-30845
6.9 Medium
-
wekan
Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading
CVE-2026-30844
9.3 Critical
-
wekan
Wekan has Cross-Board IDOR in Custom Fields Update Endpoints
CVE-2026-30843
9.3 Critical
-
wekan
WeKan Custom Translation translationBody.js setCreateTranslation improper authorization
CVE-2026-2209
5.3 Medium
-
wekan
WeKan Rules rules.js RulesBleed authorization
CVE-2026-2208
5.3 Medium
-
wekan
WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure
CVE-2026-2207
6.9 Medium
-
wekan
WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control
CVE-2026-2206
5.3 Medium
-
wekan
WeKan Meteor Publication cards.js CardPubSubBleed information disclosure
CVE-2026-2205
5.3 Medium
-
wekan
WeKan < 8.20 Migration Functionality Insufficient Permission Checks
CVE-2026-25859
7.1 High
-
wekan
WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass
CVE-2026-25568
7.1 High
-
wekan
WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId
CVE-2026-25567
5.3 Medium
-
wekan
WeKan < 8.19 Cross-board Card Move Without Destination Authorization
CVE-2026-25566
7.1 High
-
wekan
WeKan < 8.19 Read-only Board Roles Can Update Cards
CVE-2026-25565
7.1 High
-
wekan
WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation
CVE-2026-25564
7.1 High
-
wekan
WeKan < 8.19 Checklist Creation Cross-Board IDOR
CVE-2026-25563
7.1 High
-
wekan
WeKan < 8.19 Attachments Publication Information Disclosure
CVE-2026-25562
5.3 Medium
-
wekan
WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass
CVE-2026-25561
7.1 High
-
wekan
WeKan < 8.19 LDAP Authentication Filter Injection
CVE-2026-25560
8.7 High
-
wekan
WeKan REST Endpoint boards.js BoardTitleRESTBleed access control
CVE-2026-1964
5.3 Medium
-
wekan
WeKan Attachment Storage attachments.js MoveStorageBleed access control
CVE-2026-1963
5.3 Medium
-
wekan
WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control
CVE-2026-1962
5.3 Medium
-
wekan
WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control
CVE-2026-1898
5.3 Medium
-
wekan
WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization
CVE-2026-1897
5.3 Medium
-
wekan
WeKan Migration Operation comprehensiveBoardMigration.js ComprehensiveBoardMigration MigrationBleed access control
CVE-2026-1896
5.3 Medium
-
wekan
WeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access control
CVE-2026-1895
5.3 Medium
-
wekan
WeKan REST API checklistItems.js Checklist REST Bleed improper authorization
CVE-2026-1894
5.3 Medium
-
wekan
WeKan REST API boards.js setBoardOrgs improper authorization
CVE-2026-1892
2.3 Low
- Show olderLoading…