WP
Vendor
Wekan Project
39
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-30847 | WE Wekan Wekan Project | 6.5 | Mar 6 | Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens |
| CVE-2026-30846 | WE Wekan Wekan Project | 7.5 | Mar 6 | Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication |
| CVE-2026-30845 | WE Wekan Wekan Project | 8.2 | Mar 6 | Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication |
| CVE-2026-30844 | WE Wekan Wekan Project | 8.1 | Mar 6 | Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading |
| CVE-2026-30843 | WE Wekan Wekan Project | 6.5 | Mar 6 | Wekan has Cross-Board IDOR in Custom Fields Update Endpoints |
| CVE-2026-2209 | WE Wekan Wekan Project | 4.3 | Feb 8 | WeKan Custom Translation translationBody.js setCreateTranslation improper authorization |
| CVE-2026-2208 | WE Wekan Wekan Project | 6.5 | Feb 8 | WeKan Rules rules.js RulesBleed authorization |
| CVE-2026-2207 | WE Wekan Wekan Project | 5.3 | Feb 8 | WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure |
| CVE-2026-2206 | WE Wekan Wekan Project | 8.8 | Feb 8 | WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access control |
| CVE-2026-2205 | WE Wekan Wekan Project | 4.3 | Feb 8 | WeKan Meteor Publication cards.js CardPubSubBleed information disclosure |
| CVE-2026-25859 | WE Wekan Wekan Project | 8.8 | Feb 7 | WeKan < 8.20 Migration Functionality Insufficient Permission Checks |
| CVE-2026-25568 | WE Wekan Wekan Project | 4.3 | Feb 7 | WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass |
| CVE-2026-25567 | WE Wekan Wekan Project | 4.3 | Feb 7 | WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorId |
| CVE-2026-25566 | WE Wekan Wekan Project | 5.4 | Feb 7 | WeKan < 8.19 Cross-board Card Move Without Destination Authorization |
| CVE-2026-25565 | WE Wekan Wekan Project | 6.5 | Feb 7 | WeKan < 8.19 Read-only Board Roles Can Update Cards |
| CVE-2026-25564 | WE Wekan Wekan Project | 7.5 | Feb 7 | WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation |
| CVE-2026-25563 | WE Wekan Wekan Project | 7.5 | Feb 7 | WeKan < 8.19 Checklist Creation Cross-Board IDOR |
| CVE-2026-25562 | WE Wekan Wekan Project | 4.3 | Feb 7 | WeKan < 8.19 Attachments Publication Information Disclosure |
| CVE-2026-25561 | WE Wekan Wekan Project | 7.5 | Feb 7 | WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass |
| CVE-2026-25560 | WE Wekan Wekan Project | 9.8 | Feb 7 | WeKan < 8.19 LDAP Authentication Filter Injection |
| CVE-2026-1964 | WE Wekan Wekan Project | 5.3 | Feb 5 | WeKan REST Endpoint boards.js BoardTitleRESTBleed access control |
| CVE-2026-1963 | WE Wekan Wekan Project | 9.8 | Feb 5 | WeKan Attachment Storage attachments.js MoveStorageBleed access control |
| CVE-2026-1962 | WE Wekan Wekan Project | 9.8 | Feb 5 | WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control |
| CVE-2026-1898 | WE Wekan Wekan Project | 6.3 | Feb 5 | WeKan LDAP User Sync syncUser.js SyncLDAPBleed access control |
| CVE-2026-1897 | WE Wekan Wekan Project | 4.3 | Feb 5 | WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorization |
| CVE-2026-1896 | WE Wekan Wekan Project | 6.3 | Feb 4 | WeKan Migration Operation comprehensiveBoardMigration.js ComprehensiveBoardMigration MigrationBleed access control |
| CVE-2026-1895 | WE Wekan Wekan Project | 6.3 | Feb 4 | WeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access control |
| CVE-2026-1894 | WE Wekan Wekan Project | 5.4 | Feb 4 | WeKan REST API checklistItems.js Checklist REST Bleed improper authorization |
| CVE-2026-1892 | WE Wekan Wekan Project | 5.0 | Feb 4 | WeKan REST API boards.js setBoardOrgs improper authorization |
| CVE-2025-65782 | WE Wekan Wekan Project | 6.5 | Dec 15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16 |
| CVE-2025-65781 | WE Wekan Wekan Project | 8.2 | Dec 15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16 |
| CVE-2025-65780 | WE Wekan Wekan Project | 8.8 | Dec 15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16 |
| CVE-2025-65779 | WE Wekan Wekan Project | 7.5 | Dec 15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16 |
| CVE-2025-65778 | WE Wekan Wekan Project | 8.1 | Dec 15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16 |
| CVE-2023-28485 | WE Wekan Wekan Project | 5.4 | Jun 26 | A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of… |
| CVE-2023-31779 | WE Wekan Wekan Project | 5.4 | May 22 | Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS) |
| CVE-2021-20654 | WE Wekan Wekan Project | 5.4 | Feb 10 | Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scripting |
| CVE-2021-3309 | WE Wekan Wekan Project | 8.1 | Jan 26 | packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store, |
| CVE-2018-1000549 | WE Wekan Wekan Project | 5.3 | Jun 26 | Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker could perform a… |