Wekan Project Wekan vulnerabilities

• wekan Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens CVE-2026-30847 9.3 CriticalMarch 6, 2026
• wekan Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication CVE-2026-30846 8.7 HighMarch 6, 2026
• wekan Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication CVE-2026-30845 6.9 MediumMarch 6, 2026
• wekan Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading CVE-2026-30844 9.3 CriticalMarch 6, 2026
• wekan Wekan has Cross-Board IDOR in Custom Fields Update Endpoints CVE-2026-30843 9.3 CriticalMarch 6, 2026
• wekan WeKan Custom Translation translationBody.js setCreateTranslation improper authorization CVE-2026-2209 5.3 MediumFebruary 8, 2026
• wekan WeKan Rules rules.js RulesBleed authorization CVE-2026-2208 5.3 MediumFebruary 8, 2026
• wekan WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure CVE-2026-2207 6.9 MediumFebruary 8, 2026
• wekan WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control CVE-2026-2206 5.3 MediumFebruary 8, 2026
• wekan WeKan Meteor Publication cards.js CardPubSubBleed information disclosure CVE-2026-2205 5.3 MediumFebruary 8, 2026
• wekan WeKan < 8.20 Migration Functionality Insufficient Permission Checks CVE-2026-25859 7.1 HighFebruary 7, 2026
• wekan WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass CVE-2026-25568 7.1 HighFebruary 7, 2026
• wekan WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId CVE-2026-25567 5.3 MediumFebruary 7, 2026
• wekan WeKan < 8.19 Cross-board Card Move Without Destination Authorization CVE-2026-25566 7.1 HighFebruary 7, 2026
• wekan WeKan < 8.19 Read-only Board Roles Can Update Cards CVE-2026-25565 7.1 HighFebruary 7, 2026
• wekan WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation CVE-2026-25564 7.1 HighFebruary 7, 2026
• wekan WeKan < 8.19 Checklist Creation Cross-Board IDOR CVE-2026-25563 7.1 HighFebruary 7, 2026
• wekan WeKan < 8.19 Attachments Publication Information Disclosure CVE-2026-25562 5.3 MediumFebruary 7, 2026
• wekan WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass CVE-2026-25561 7.1 HighFebruary 7, 2026
• wekan WeKan < 8.19 LDAP Authentication Filter Injection CVE-2026-25560 8.7 HighFebruary 7, 2026
• wekan WeKan REST Endpoint boards.js BoardTitleRESTBleed access control CVE-2026-1964 5.3 MediumFebruary 5, 2026
• wekan WeKan Attachment Storage attachments.js MoveStorageBleed access control CVE-2026-1963 5.3 MediumFebruary 5, 2026
• wekan WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control CVE-2026-1962 5.3 MediumFebruary 5, 2026
• wekan WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control CVE-2026-1898 5.3 MediumFebruary 5, 2026
• wekan WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization CVE-2026-1897 5.3 MediumFebruary 5, 2026
• wekan WeKan Migration Operation comprehensiveBoardMigration.js ComprehensiveBoardMigration MigrationBleed access control CVE-2026-1896 5.3 MediumFebruary 4, 2026
• wekan WeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access control CVE-2026-1895 5.3 MediumFebruary 4, 2026
• wekan WeKan REST API checklistItems.js Checklist REST Bleed improper authorization CVE-2026-1894 5.3 MediumFebruary 4, 2026
• wekan WeKan REST API boards.js setBoardOrgs improper authorization CVE-2026-1892 2.3 LowFebruary 4, 2026
• wekan project wekan An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed... CVE-2025-65782 6.5 MediumDecember 15, 2025
• wekan project wekan An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed... CVE-2025-65781 8.2 HighDecember 15, 2025
• wekan project wekan An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed... CVE-2025-65780 8.8 HighDecember 15, 2025
• wekan project wekan An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed... CVE-2025-65779 7.5 HighDecember 15, 2025
• wekan project wekan An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed... CVE-2025-65778 8.1 HighDecember 15, 2025
• wekan project wekan A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75... CVE-2023-28485 5.4 MediumJune 26, 2023
• wekan project wekan Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). An attacker with user... CVE-2023-31779 Public exploit 5.4 MediumMay 22, 2023
• wekan Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple... CVE-2021-20654 5.4 MediumFebruary 10, 2021
• wekan project wekan packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they... CVE-2021-3309 8.1 HighJanuary 26, 2021
• wekan project wekan Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and ... CVE-2018-1000549 5.3 MediumJune 26, 2018