Go-vikunja vulnerabilities
105 CVEs and advisories name Go-vikunja as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-123531Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter
- CVE-2026-123530Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints
- CVE-2026-123529Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color
- CVE-2026-123528Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware
- CVE-2026-123527Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass
- CVE-2026-123526Vikunja before 2.7.1 Mass Assignment via Team external_id Field
- CVE-2026-123525Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations
- CVE-2026-123524Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload
- CVE-2026-123523Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache
- CVE-2026-123522Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook
- CVE-2026-123521Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint
- CVE-2026-123520Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion
- CVE-2026-123519Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports
- CVE-2026-123518Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move
- CVE-2026-123517Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint
- CVE-2026-123516Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import
- CVE-2026-123515Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Images
- CVE-2026-123514Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion
- CVE-2026-123513Vikunja before 2.7.1 Auth Token Leak via API URL Change
- CVE-2026-123512Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs
- CVE-2026-123511Vikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entries
- CVE-2026-123510Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath
- CVE-2026-123509Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Count
- CVE-2026-123508Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain
- CVE-2026-123507Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter
- CVE-2026-123506Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints
- CVE-2026-123505Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database
- CVE-2026-123504Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members
- CVE-2026-123503Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion
- CVE-2026-123502Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logging