Affected version lines
Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2026-123531 | Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter | ≥ 1.0.0 < 2.7.1 | 8.7 | — | 2026-11-08 | |
| CVE-2026-123530 | Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints | < 2.7.1 | 6.0 | — | 2026-11-08 | |
| CVE-2026-123529 | Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color | < 2.7.1 | 5.1 | — | 2026-11-08 | |
| CVE-2026-123528 | Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware | < 2.7.1 | 7.6 | — | 2026-11-08 | |
| CVE-2026-123527 | Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass | ≥ 2.4.0 < 2.7.1 | 5.3 | — | 2026-11-08 | |
| CVE-2026-123526 | Vikunja before 2.7.1 Mass Assignment via Team external_id Field | < 2.7.1 | 5.3 | — | 2026-11-08 | |
| CVE-2026-123524 | Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload | ≥ 0.23.0 < 2.7.1 | 6.9 | — | 2026-11-08 | |
| CVE-2026-123525 | Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations | < 2.7.1 | 7.1 | — | 2026-11-08 | |
| CVE-2026-123523 | Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache | < 2.7.1 | 7.1 | — | 2026-11-08 | |
| CVE-2026-123522 | Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook | < 2.7.1 | 7.1 | — | 2026-11-08 | |
| CVE-2026-123521 | Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint | < 2.7.1 | 6.0 | — | 2026-11-08 | |
| CVE-2026-123520 | Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion | ≥ 0.18.0 < 2.7.1 | 7.1 | — | 2026-11-08 | |
| CVE-2026-123519 | Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports | < 2.7.1 | 7.1 | — | 2026-11-08 | |
| CVE-2026-123518 | Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move | < 2.7.1 | 5.3 | — | 2026-11-08 | |
| CVE-2026-123517 | Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint | < 2.7.1 | 7.1 | — | 2026-11-08 | |
| CVE-2026-123516 | Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import | < 2.7.1 | 7.1 | — | 2026-11-08 | |
| CVE-2026-123515 | Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Images | < 2.7.1 | 5.1 | — | 2026-11-08 | |
| CVE-2026-123514 | Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion | < 2.7.1 | 5.3 | — | 2026-11-08 | |
| CVE-2026-123512 | Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs | < 2.7.1 | 8.4 | — | 2026-11-08 | |
| CVE-2026-123513 | Vikunja before 2.7.1 Auth Token Leak via API URL Change | < 2.7.1 | 7.6 | — | 2026-11-08 | |
| CVE-2026-123511 | Vikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entries | < 2.7.1 | 5.3 | — | 2026-11-08 | |
| CVE-2026-123509 | Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Count | < 2.7.1 | 5.3 | — | 2026-11-08 | |
| CVE-2026-123510 | Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath | < 2.7.1 | 1.0 | — | 2026-11-08 | |
| CVE-2026-123508 | Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain | < 2.7.1 | 2.0 | — | 2026-11-08 | |
| CVE-2026-123507 | Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter | ≥ 0.24.0 < 2.7.1 | 5.1 | — | 2026-11-08 | |
| CVE-2026-123506 | Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints | ≥ 2.2.0 < 2.7.1 | 5.3 | — | 2026-11-08 | |
| CVE-2026-123505 | Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database | < 2.7.1 | 6.8 | — | 2026-11-08 | |
| CVE-2026-123503 | Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion | < 2.7.1 | 5.3 | — | 2026-11-08 | |
| CVE-2026-123504 | Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members | ≥ 0.22.0 < 2.7.1 | 5.3 | — | 2026-11-08 | |
| CVE-2026-123502 | Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logging | < 2.7.1 | 6.9 | — | 2026-11-08 | |
| CVE-2026-123501 | Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes | < 2.7.1 | 7.1 | — | 2026-11-08 | |
| CVE-2026-123500 | Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump | < 2.7.1 | 6.9 | — | 2026-11-08 | |
| CVE-2026-123499 | Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server | < 2.7.1 | 6.0 | — | 2026-11-08 | |
| CVE-2026-123498 | Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata | < 2.7.1 | 2.1 | — | 2026-11-08 | |
| CVE-2026-123496 | Vikunja veans before 2.7.1 Symlink Following in veans init | < 2.7.1 | 4.8 | — | 2026-11-08 | |
| CVE-2026-123497 | Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery | < 2.7.1 | 7.6 | — | 2026-11-08 | |
| CVE-2026-123495 | Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback | ≥ 2.0.0 < 2.7.1 | 5.1 | — | 2026-11-08 | |
| CVE-2026-123494 | Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks | < 2.7.1 | 5.1 | — | 2026-11-08 | |
| CVE-2026-123493 | Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens | ≥ 2.4.0 < 2.7.1 | 5.3 | — | 2026-11-08 | |
| CVE-2026-115507 | Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header | ≥ 2.2.0 < 2.7.1 | 5.1 | — | 2026-10-23 | |
| CVE-2026-111921 | Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion | ≥ 0.13.0 < 2.7.0 | 5.3 | — | 2026-10-18 | |
| CVE-2026-111922 | Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins | ≥ 2.2.0 < 2.7.0 | 7.2 | — | 2026-10-18 | |
| CVE-2026-111920 | Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions | = 2.6.0 | 5.3 | — | 2026-10-18 | |
| CVE-2026-111918 | Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation | ≥ 1.0.0-rc0 < 2.7.0 | 5.3 | — | 2026-10-18 | |
| CVE-2026-111919 | Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks | ≥ 0.22.0 < 2.7.0 | 7.1 | — | 2026-10-18 | |
| CVE-2026-111917 | Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation | ≥ 2.3.0 < 2.7.0 | 7.1 | — | 2026-10-18 | |
| CVE-2026-62376 | Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB r... | * | 8.1 | — | 2026-10-10 | |
| CVE-2026-62367 | Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover | * | 7.5 | — | 2026-10-10 | |
| CVE-2026-57458 | Vikunja: Scoped API token can mint unrestricted OAuth session credentials | * | 8.1 | — | 2026-10-10 | |
| CVE-2026-91985 | Vikunja before 2.6.0 Privilege Escalation via Link Share Hash | < 2.6.0 | 8.7 | — | 2026-09-16 | |
| CVE-2026-91984 | Vikunja before 2.6.0 Broken Object-Level Authorization via task-position | < 2.6.0 | 5.3 | — | 2026-09-16 | |
| CVE-2026-91982 | Vikunja before 2.6.0 TOTP Secret Disclosure via API | < 2.6.0 | 5.3 | — | 2026-09-16 | |
| CVE-2026-91983 | Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter | ≥ 1.0.0 < 2.6.0 | 5.3 | — | 2026-09-16 | |
| CVE-2026-91981 | Vikunja before 2.6.0 User Enumeration via v2 API | < 2.6.0 | 5.3 | — | 2026-09-16 | |
| CVE-2026-91979 | Vikunja before 2.6.0 Denial of Service via Decompression Bomb | < 2.6.0 | 7.1 | — | 2026-09-16 | |
| CVE-2026-91980 | vikunja before 2.6.0 Team Enumeration via Project Share | < 2.6.0 | 5.3 | — | 2026-09-16 | |
| CVE-2026-91973 | Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth | < 2.6.0 | 8.7 | — | 2026-09-16 | |
| CVE-2026-91972 | Vikunja before 2.6.0 Authentication Bypass via Unthrottled API | < 2.6.0 | 8.7 | — | 2026-09-16 | |
| CVE-2026-91971 | Vikunja before 2.6.0 Denial of Service via Avatar Upload | < 2.6.0 | 7.1 | — | 2026-09-16 | |
| CVE-2026-91970 | Vikunja before 2.6.0 Resource Exhaustion via Planka Migration | < 2.6.0 | 7.1 | — | 2026-09-16 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).