WE
Vendor
wekan
35
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-68901 | WE wekan wekan | 6.5 | Aug 19 | WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service |
| CVE-2026-68900 | WE wekan wekan | 7.6 | Aug 19 | Wekan: Stored XSS in HTML board exports through a card-title second parse |
| CVE-2026-68899 | WE wekan wekan | 8.7 | Aug 19 | Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback |
| CVE-2026-68561 | WE wekan wekan | 8.8 | Aug 19 | Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule |
| CVE-2026-68560 | WE wekan wekan | 7.7 | Aug 19 | Wekan:hell Injection in External Antivirus Scanner Path via asyncExec |
| CVE-2026-68558 | WE wekan wekan | 8.5 | Aug 19 | Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446) |
| CVE-2026-68559 | WE wekan wekan | 6.5 | Aug 19 | Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`) |
| CVE-2026-55652 | WE wekan wekan | 9.8 | Jul 15 | Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin) |
| CVE-2026-55234 | WE wekan wekan | 8.5 | Jul 15 | Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule) |
| CVE-2026-53447 | WE wekan wekan | 6.5 | Jul 15 | Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID |
| CVE-2026-52893 | WE wekan wekan | 9.2 | Jul 15 | Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook |
| CVE-2026-53444 | WE wekan wekan | 7.6 | Jul 15 | Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin |
| CVE-2026-53445 | WE wekan wekan | 7.1 | Jul 15 | Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards |
| CVE-2026-53446 | WE wekan wekan | 6.2 | Jul 15 | Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLs |
| CVE-2026-52892 | WE wekan wekan | 6.5 | Jul 15 | Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops) |
| CVE-2026-52891 | WE wekan wekan | 9.9 | Jul 15 | Wekan: Shell Injection via Avatar Upload |
| CVE-2026-52890 | WE wekan wekan | 7.1 | Jul 15 | Wekan: Arbitrary file read and server DoS via attachment versions.original.path |
| CVE-2026-59154 | WE wekan wekan | 4.3 | Jul 10 | Wekan: Checklist direct DDP updates can write checklist data into private boards |
| CVE-2026-41455 | WE wekan wekan | 8.5 | Apr 22 | WeKan < 8.35 SSRF via Webhook URL |
| CVE-2026-41454 | WE wekan wekan | 8.3 | Apr 22 | WeKan < 8.35 Missing Authorization via Integration REST API |
| CVE-2026-30847 | WE Wekan Wekan | 6.5 | Mar 6 | Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens |
| CVE-2026-30846 | WE Wekan Wekan | 7.5 | Mar 6 | Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication |
| CVE-2026-30845 | WE Wekan Wekan | 8.2 | Mar 6 | Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication |
| CVE-2026-30844 | WE Wekan Wekan | 8.1 | Mar 6 | Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading |
| CVE-2026-30843 | WE Wekan Wekan | 6.5 | Mar 6 | Wekan has Cross-Board IDOR in Custom Fields Update Endpoints |
| CVE-2026-25859 | WE WeKan WeKan | 8.8 | Feb 7 | WeKan < 8.20 Migration Functionality Insufficient Permission Checks |
| CVE-2026-25568 | WE WeKan WeKan | 4.3 | Feb 7 | WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass |
| CVE-2026-25567 | WE WeKan WeKan | 4.3 | Feb 7 | WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId |
| CVE-2026-25566 | WE WeKan WeKan | 5.4 | Feb 7 | WeKan < 8.19 Cross-board Card Move Without Destination Authorization |
| CVE-2026-25565 | WE WeKan WeKan | 6.5 | Feb 7 | WeKan < 8.19 Read-only Board Roles Can Update Cards |
| CVE-2026-25564 | WE WeKan WeKan | 7.5 | Feb 7 | WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation |
| CVE-2026-25563 | WE WeKan WeKan | 7.5 | Feb 7 | WeKan < 8.19 Checklist Creation Cross-Board IDOR |
| CVE-2026-25562 | WE WeKan WeKan | 4.3 | Feb 7 | WeKan < 8.19 Attachments Publication Information Disclosure |
| CVE-2026-25561 | WE WeKan WeKan | 7.5 | Feb 7 | WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass |
| CVE-2026-25560 | WE WeKan WeKan | 9.8 | Feb 7 | WeKan < 8.19 LDAP Authentication Filter Injection |