Go-vikunja vulnerabilities
105 CVEs and advisories name Go-vikunja as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-123501Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes
- CVE-2026-123500Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump
- CVE-2026-123499Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server
- CVE-2026-123498Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata
- CVE-2026-123497Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery
- CVE-2026-123496Vikunja veans before 2.7.1 Symlink Following in veans init
- CVE-2026-123495Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback
- CVE-2026-123494Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks
- CVE-2026-123493Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens
- CVE-2026-115507Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header
- CVE-2026-111922Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins
- CVE-2026-111921Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion
- CVE-2026-111920Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions
- CVE-2026-111919Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks
- CVE-2026-111918Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation
- CVE-2026-111917Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation
- CVE-2026-62376Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
- CVE-2026-62367Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
- CVE-2026-57458Vikunja: Scoped API token can mint unrestricted OAuth session credentials
- CVE-2026-91985Vikunja before 2.6.0 Privilege Escalation via Link Share Hash
- CVE-2026-91984Vikunja before 2.6.0 Broken Object-Level Authorization via task-position
- CVE-2026-91983Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter
- CVE-2026-91982Vikunja before 2.6.0 TOTP Secret Disclosure via API
- CVE-2026-91981Vikunja before 2.6.0 User Enumeration via v2 API
- CVE-2026-91980vikunja before 2.6.0 Team Enumeration via Project Share
- CVE-2026-91979Vikunja before 2.6.0 Denial of Service via Decompression Bomb
- CVE-2026-91973Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth
- CVE-2026-91972Vikunja before 2.6.0 Authentication Bypass via Unthrottled API
- CVE-2026-91971Vikunja before 2.6.0 Denial of Service via Avatar Upload
- CVE-2026-91970Vikunja before 2.6.0 Resource Exhaustion via Planka Migration