VI
Product
vikunja
66
CVEs
0
On KEV
9.8
Max CVSS
10
New 30D
Severity mix
Critical 4High 21Medium 40Low 1
Watch
Add vikunja to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-29794 | 5.3 | Mar 20 | Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers Affected: >= 0.8, < 2.2.0 |
| CVE-2026-55067 | 5.0 | Aug 28 | Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment Affected: < 2.4.0 |
| CVE-2026-33700 | 4.9 | Mar 24 | Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion Affected: < 2.2.1 |
| CVE-2026-111920 | 4.3 | Oct 17 | Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions Affected: 2.6.0 |
| CVE-2026-91984 | 4.3 | Sep 15 | Vikunja before 2.6.0 Broken Object-Level Authorization via task-position Affected: before 2.6.0 |
| CVE-2026-91983 | 4.3 | Sep 15 | Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter Affected: 1.0.0 before 2.6.0 |
| CVE-2026-91982 | 4.3 | Sep 15 | Vikunja before 2.6.0 TOTP Secret Disclosure via API Affected: before 2.6.0 |
| CVE-2026-91981 | 4.3 | Sep 15 | Vikunja before 2.6.0 User Enumeration via v2 API Affected: before 2.6.0 |
| CVE-2026-91980 | 4.3 | Sep 15 | vikunja before 2.6.0 Team Enumeration via Project Share Affected: before 2.6.0 |
| CVE-2026-55064 | 4.3 | Aug 28 | Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 Affected: >= 2.3.0, < 2.4.0 |
| CVE-2026-35598 | 4.3 | Apr 10 | Vikunja has Missing Authorization on CalDAV Task Read Affected: < 2.3.0 |
| CVE-2026-35596 | 4.3 | Apr 10 | Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug Affected: < 2.3.0 |
| CVE-2026-33315 | 4.3 | Mar 24 | Vikunja has a 2FA Bypass via Caldav Basic Auth Affected: < 2.2.0 |
| CVE-2026-33313 | 4.3 | Mar 24 | Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments Affected: < 2.2.0 |
| CVE-2026-35601 | 4.1 | Apr 10 | Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output Affected: < 2.3.0 |
| CVE-2026-115507 New | 3.5 | Oct 22 | Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header Affected: 2.2.0 before 2.7.1 |