CVEs
Browse the synced catalog, newest first.
- CVE-2026-123527Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypassgo-vikunja vikunja
- CVE-2026-123526Vikunja before 2.7.1 Mass Assignment via Team external_id Fieldgo-vikunja vikunja
- CVE-2026-123525Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrationsgo-vikunja vikunja
- CVE-2026-123524Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payloadgo-vikunja vikunja
- CVE-2026-123523Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cachego-vikunja vikunja
- CVE-2026-123522Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhookgo-vikunja vikunja
- CVE-2026-123521Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpointgo-vikunja vikunja
- CVE-2026-123520Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletiongo-vikunja vikunja
- CVE-2026-123519Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Importsgo-vikunja vikunja
- CVE-2026-123518Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Movego-vikunja vikunja
- CVE-2026-123517Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpointgo-vikunja vikunja
- CVE-2026-123516Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Importgo-vikunja vikunja
- CVE-2026-123515Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Imagesgo-vikunja vikunja
- CVE-2026-123514Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustiongo-vikunja vikunja
- CVE-2026-123513Vikunja before 2.7.1 Auth Token Leak via API URL Changego-vikunja vikunja
- CVE-2026-123512Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logsgo-vikunja vikunja
- CVE-2026-123511Vikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entriesgo-vikunja vikunja
- CVE-2026-123510Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpathgo-vikunja vikunja
- CVE-2026-123509Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Countgo-vikunja vikunja
- CVE-2026-123508Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchaingo-vikunja vikunja
- CVE-2026-123507Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filtergo-vikunja vikunja
- CVE-2026-123506Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpointsgo-vikunja vikunja
- CVE-2026-123505Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Databasego-vikunja vikunja
- CVE-2026-123504Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Membersgo-vikunja vikunja
- CVE-2026-123503Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletiongo-vikunja vikunja
- CVE-2026-123502Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logginggo-vikunja vikunja
- CVE-2026-123501Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodesgo-vikunja vikunja
- CVE-2026-123500Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dumpgo-vikunja vikunja
- CVE-2026-123499Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Servergo-vikunja vikunja
- CVE-2026-123498Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadatago-vikunja vikunja