Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 98

Export CSV
CVE-2026-123502

Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logging

Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of the /shares/:share/auth route. Attackers with access to Vikunja or reverse proxy access logs can reuse non-expiring, non-password-protected share hashes to obtain a project JWT with read, write or admin permission.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123498

Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata

Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft ProjectTitle or task descriptions that the prime hook loads on SessionStart and PreCompact, causing the agent to modify the developer's checkout or run commands.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123494

Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks

Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the unused callback code or token, and lure a logged-in victim to the migration callback route to auto-import attacker-chosen projects and tasks containing phishing links.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123520

Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion

Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-only shared projects by deleting accounts. Attackers can create a bot, add it to their team, and delete it through the bots endpoint, triggering ensureProjectAdminUser to promote read-only shares and lock out the real owner.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Go-vikunja Vikunja
Products
Vikunja Vikunja
CVE-2026-123524

Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload

Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators with write access to read tasks from inaccessible projects by registering webhooks. Because webhook payloads are built with the triggering user's permissions, attackers receive related_tasks titles, descriptions and metadata from private projects whenever another user modifies a linked task.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Go-vikunja Vikunja
Products
Vikunja Vikunja
CVE-2026-123508

Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain

Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature.

CVSS 4.0 · 2 Low EPSS < 1% KEV · Not listed
Vendors
Go-vikunja Vikunja
Products
Vikunja Vikunja
CVE-2026-123531

Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter

Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to bypass service.maxitemsperpage by sending page=0 to /api/v1 list endpoints. Attackers can self-register and repeatedly request page=0 to force unbounded SQL queries, memory materialisation, and per-row query fan-out, degrading availability for other users.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123528

Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware

Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access tokens to keep authenticating because SetupTokenMiddleware skips session and account-status checks. Attackers with a stolen token can, after logout, password reset, or account disabling, mint OAuth sessions via /oauth/authorize or tk_ API tokens for persistent access.

CVSS 4.0 · 7.6 High EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123527

Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass

Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123523

Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, caching roughly a gigabyte per account without eviction and causing the API process to be OOM-killed.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123519

Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports

Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a ~22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the wekan migrate endpoint, triggering OOM and crashing the instance.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123516

Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import

Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the per-entry caps, forcing scanArchive to process every entry twice.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123515

Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Images

Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123512

Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs

Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so the full request URI, including the token, is written to Vikunja's HTTP access log and any reverse-proxy logs when a user clicks the link. Attackers with read access to those logs can replay an unredeemed password-reset token to take over the account or an account-deletion token to confirm the deletion.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123511

Vikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entries

Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV clients to create unbounded dummy tasks by sending VTODOs with thousands of RELATED-TO properties. Attackers can repeat unknown related UIDs in a single PUT request to generate thousands of task, relation, and event rows, bloating the database and overloading the event pipeline.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123507

Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter

Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in kanban and task collection code, returning HTTP 500 to all project members.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123504

Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members

Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target_url values to post to receiving channels or reuse keys until rotated.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123500

Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump

Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask permissions by the vikunja dump command. Local attackers on a shared host can read the world-readable zip in the rootpath to obtain config, password hashes, TOTP secrets, tokens, and stored files.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123496

Vikunja veans before 2.7.1 Symlink Following in veans init

Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-115507

Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject phishing links into task-comment and task-mention notification emails sent to project members.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja