Go-vikunja vulnerabilities
105 CVEs and advisories name Go-vikunja as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-33473Vikunja has TOTP Reuse During Validity Window
- CVE-2026-33336Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation
- CVE-2026-33335Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal
- CVE-2026-33334Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration
- CVE-2026-33316Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement
- CVE-2026-33315Vikunja has a 2FA Bypass via Caldav Basic Auth
- CVE-2026-33313Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Comments
- CVE-2026-33312Read-only Vikunja users can delete project background images via broken object-level authorization
- CVE-2026-29794Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers
- CVE-2026-28268Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
- CVE-2026-27819Vikunja has Path Traversal in CLI Restore
- CVE-2026-27616Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure
- CVE-2026-27575Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
- CVE-2026-27116Vikunja has Reflected HTML Injection via filter Parameter in Projects Module
- CVE-2026-25935Vikunja Affected by XSS Via Task Preview