Login Request a demo
GO
Vendor
go-vikunja
1 product with CVEs on record
66
CVEs
0
On KEV
10
New 30D
Products
VI
vikunja
go-vikunja
9.8
66 CVEs0 on KEV10 new
Recent CVEs
CVEProductCVSSEPSSPublishedSummary
CVE-2026-115507
New
VI
vikunja
go-vikunja
3.5
0%
Oct 22Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header
CVE-2026-111922
VI
vikunja
go-vikunja
6.3
0%
Oct 17Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins
CVE-2026-111921
VI
vikunja
go-vikunja
5.4
0%
Oct 17Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion
CVE-2026-111920
VI
vikunja
go-vikunja
4.3
0%
Oct 17Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions
CVE-2026-111919
VI
vikunja
go-vikunja
6.5
0%
Oct 17Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
CVE-2026-111918
VI
vikunja
go-vikunja
5.4
0%
Oct 17Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation
CVE-2026-111917
VI
vikunja
go-vikunja
6.5
0%
Oct 17Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation
CVE-2026-62376
VI
vikunja
go-vikunja
8.1
0%
Oct 9Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
CVE-2026-62367
VI
vikunja
go-vikunja
7.5
0%
Oct 9Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
CVE-2026-57458
VI
vikunja
go-vikunja
8.1
0%
Oct 9Vikunja: Scoped API token can mint unrestricted OAuth session credentials
CVE-2026-91985
VI
vikunja
go-vikunja
7.5
0%
Sep 15Vikunja before 2.6.0 Privilege Escalation via Link Share Hash
CVE-2026-91984
VI
vikunja
go-vikunja
4.3
0%
Sep 15Vikunja before 2.6.0 Broken Object-Level Authorization via task-position
CVE-2026-91983
VI
vikunja
go-vikunja
4.3
0%
Sep 15Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter
CVE-2026-91982
VI
vikunja
go-vikunja
4.3
0%
Sep 15Vikunja before 2.6.0 TOTP Secret Disclosure via API
CVE-2026-91981
VI
vikunja
go-vikunja
4.3
0%
Sep 15Vikunja before 2.6.0 User Enumeration via v2 API
CVE-2026-91980
VI
vikunja
go-vikunja
4.3
0%
Sep 15vikunja before 2.6.0 Team Enumeration via Project Share
CVE-2026-91979
VI
vikunja
go-vikunja
6.5
0%
Sep 15Vikunja before 2.6.0 Denial of Service via Decompression Bomb
CVE-2026-91973
VI
vikunja
go-vikunja
7.5
1%
Sep 15Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth
CVE-2026-91972
VI
vikunja
go-vikunja
7.5
1%
Sep 15Vikunja before 2.6.0 Authentication Bypass via Unthrottled API
CVE-2026-91971
VI
vikunja
go-vikunja
6.5
0%
Sep 15Vikunja before 2.6.0 Denial of Service via Avatar Upload
CVE-2026-91970
VI
vikunja
go-vikunja
6.5
0%
Sep 15Vikunja before 2.6.0 Resource Exhaustion via Planka Migration
CVE-2026-91969
VI
vikunja
go-vikunja
6.5
0%
Sep 15vikunja before 2.6.0 Resource Exhaustion via CSV Migration
CVE-2026-91968
VI
vikunja
go-vikunja
6.5
0%
Sep 15vikunja before 2.6.0 Denial of Service via unbounded filter recursion
CVE-2026-55067
VI
vikunja
go-vikunja
5.0
0%
Aug 28Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment
CVE-2026-55066
VI
vikunja
go-vikunja
7.1
0%
Aug 28Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id
CVE-2026-55065
VI
vikunja
go-vikunja
8.1
1%
Aug 28Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api
CVE-2026-55064
VI
vikunja
go-vikunja
4.3
0%
Aug 28Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0
CVE-2026-54766
VI
vikunja
go-vikunja
5.3
0%
Aug 28Vikunja: Project duplication bypasses write-permission check on the target parent project
CVE-2026-76216
VI
vikunja
go-vikunja
7.5
0%
Aug 19Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing
CVE-2026-68582
VI
vikunja
go-vikunja
6.5
0%
Aug 2Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token
CVE-2026-68581
VI
vikunja
go-vikunja
8.1
0%
Aug 2Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision
CVE-2026-40103
VI
vikunja
go-vikunja
5.4
0%
Apr 10Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds
CVE-2026-35602
VI
vikunja
go-vikunja
7.1
0%
Apr 10Vikunja has a File Size Limit Bypass via Vikunja Import
CVE-2026-35601
VI
vikunja
go-vikunja
4.1
0%
Apr 10Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Output
CVE-2026-35600
VI
vikunja
go-vikunja
5.4
0%
Apr 10Vikunja has HTML Injection via Task Titles in Overdue Email Notifications
CVE-2026-35599
VI
vikunja
go-vikunja
6.5
0%
Apr 10Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler
CVE-2026-35598
VI
vikunja
go-vikunja
4.3
0%
Apr 10Vikunja has Missing Authorization on CalDAV Task Read
CVE-2026-35597
VI
vikunja
go-vikunja
7.5
0%
Apr 10Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout
CVE-2026-35596
VI
vikunja
go-vikunja
4.3
0%
Apr 10Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Bug
CVE-2026-35595
VI
vikunja
go-vikunja
8.3
0%
Apr 10Vikunja Affected by Privilege Escalation via Project Reparenting
CVE-2026-35594
VI
vikunja
go-vikunja
6.5
0%
Apr 10Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade
CVE-2026-34727
VI
vikunja
go-vikunja
9.1
0%
Apr 10Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path
CVE-2026-33700
VI
vikunja
go-vikunja
4.9
0%
Mar 24Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion
CVE-2026-33680
VI
vikunja
go-vikunja
6.5
0%
Mar 24Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation
CVE-2026-33679
VI
vikunja
go-vikunja
7.4
0%
Mar 24Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections
CVE-2026-33678
VI
vikunja
go-vikunja
8.1
0%
Mar 24Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion
CVE-2026-33677
VI
vikunja
go-vikunja
6.5
0%
Mar 24Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API
CVE-2026-33676
VI
vikunja
go-vikunja
6.5
0%
Mar 24Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read
CVE-2026-33675
VI
vikunja
go-vikunja
5.4
0%
Mar 24Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources
CVE-2026-33668
VI
vikunja
go-vikunja
8.1
0%
Mar 24Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect
CVE-2026-33474
VI
vikunja
go-vikunja
6.5
0%
Mar 24Vikunja Affected by DoS via Image Preview Generation
CVE-2026-33473
VI
vikunja
go-vikunja
5.7
0%
Mar 24Vikunja has TOTP Reuse During Validity Window
CVE-2026-33336
VI
vikunja
go-vikunja
8.8
1%
Mar 24Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation
CVE-2026-33335
VI
vikunja
go-vikunja
8.0
0%
Mar 24Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal
CVE-2026-33334
VI
vikunja
go-vikunja
9.6
0%
Mar 24Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration
CVE-2026-33316
VI
vikunja
go-vikunja
8.1
0%
Mar 24Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement
CVE-2026-33315
VI
vikunja
go-vikunja
4.3
0%
Mar 24Vikunja has a 2FA Bypass via Caldav Basic Auth
CVE-2026-33313
VI
vikunja
go-vikunja
4.3
0%
Mar 24Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments
CVE-2026-33312
VI
vikunja
go-vikunja
5.4
0%
Mar 20Read-only Vikunja users can delete project background images via broken object-level authorization
CVE-2026-29794
VI
vikunja
go-vikunja
5.3
0%
Mar 20Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers