InfraGuard
ログイン 今すぐ試す 今すぐ購入

Vikunja の脆弱性（CVE一覧）

105 CVE9.8 最大CVSS

影響を受けるバージョン系列

既知の脆弱性

CVE タイトル 影響を受けるバージョン CVSS 悪用 EPSS 公開日
CVE-2026-123531 Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter ≥ 1.0.0 < 2.7.1 8.7 — 2026-11-08
CVE-2026-123530 Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints < 2.7.1 6.0 — 2026-11-08
CVE-2026-123529 Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color < 2.7.1 5.1 — 2026-11-08
CVE-2026-123528 Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware < 2.7.1 7.6 — 2026-11-08
CVE-2026-123527 Vikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization Bypass ≥ 2.4.0 < 2.7.1 5.3 — 2026-11-08
CVE-2026-123526 Vikunja before 2.7.1 Mass Assignment via Team external_id Field < 2.7.1 5.3 — 2026-11-08
CVE-2026-123524 Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload ≥ 0.23.0 < 2.7.1 6.9 — 2026-11-08
CVE-2026-123525 Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations < 2.7.1 7.1 — 2026-11-08
CVE-2026-123523 Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache < 2.7.1 7.1 — 2026-11-08
CVE-2026-123522 Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook < 2.7.1 7.1 — 2026-11-08
CVE-2026-123521 Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint < 2.7.1 6.0 — 2026-11-08
CVE-2026-123520 Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion ≥ 0.18.0 < 2.7.1 7.1 — 2026-11-08
CVE-2026-123519 Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports < 2.7.1 7.1 — 2026-11-08
CVE-2026-123518 Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move < 2.7.1 5.3 — 2026-11-08
CVE-2026-123517 Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint < 2.7.1 7.1 — 2026-11-08
CVE-2026-123516 Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import < 2.7.1 7.1 — 2026-11-08
CVE-2026-123515 Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Images < 2.7.1 5.1 — 2026-11-08
CVE-2026-123514 Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion < 2.7.1 5.3 — 2026-11-08
CVE-2026-123512 Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs < 2.7.1 8.4 — 2026-11-08
CVE-2026-123513 Vikunja before 2.7.1 Auth Token Leak via API URL Change < 2.7.1 7.6 — 2026-11-08
CVE-2026-123511 Vikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entries < 2.7.1 5.3 — 2026-11-08
CVE-2026-123509 Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Count < 2.7.1 5.3 — 2026-11-08
CVE-2026-123510 Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath < 2.7.1 1.0 — 2026-11-08
CVE-2026-123508 Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain < 2.7.1 2.0 — 2026-11-08
CVE-2026-123507 Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter ≥ 0.24.0 < 2.7.1 5.1 — 2026-11-08
CVE-2026-123506 Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints ≥ 2.2.0 < 2.7.1 5.3 — 2026-11-08
CVE-2026-123505 Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database < 2.7.1 6.8 — 2026-11-08
CVE-2026-123503 Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion < 2.7.1 5.3 — 2026-11-08
CVE-2026-123504 Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members ≥ 0.22.0 < 2.7.1 5.3 — 2026-11-08
CVE-2026-123502 Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logging < 2.7.1 6.9 — 2026-11-08
CVE-2026-123501 Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes < 2.7.1 7.1 — 2026-11-08
CVE-2026-123500 Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump < 2.7.1 6.9 — 2026-11-08
CVE-2026-123499 Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server < 2.7.1 6.0 — 2026-11-08
CVE-2026-123498 Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata < 2.7.1 2.1 — 2026-11-08
CVE-2026-123496 Vikunja veans before 2.7.1 Symlink Following in veans init < 2.7.1 4.8 — 2026-11-08
CVE-2026-123497 Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery < 2.7.1 7.6 — 2026-11-08
CVE-2026-123495 Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback ≥ 2.0.0 < 2.7.1 5.1 — 2026-11-08
CVE-2026-123494 Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks < 2.7.1 5.1 — 2026-11-08
CVE-2026-123493 Vikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API Tokens ≥ 2.4.0 < 2.7.1 5.3 — 2026-11-08
CVE-2026-115507 Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header ≥ 2.2.0 < 2.7.1 5.1 — 2026-10-23
CVE-2026-111921 Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion ≥ 0.13.0 < 2.7.0 5.3 — 2026-10-18
CVE-2026-111922 Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins ≥ 2.2.0 < 2.7.0 7.2 — 2026-10-18
CVE-2026-111920 Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions = 2.6.0 5.3 — 2026-10-18
CVE-2026-111918 Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation ≥ 1.0.0-rc0 < 2.7.0 5.3 — 2026-10-18
CVE-2026-111919 Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks ≥ 0.22.0 < 2.7.0 7.1 — 2026-10-18
CVE-2026-111917 Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation ≥ 2.3.0 < 2.7.0 7.1 — 2026-10-18
CVE-2026-62376 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB r... * 8.1 — 2026-10-10
CVE-2026-62367 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover * 7.5 — 2026-10-10
CVE-2026-57458 Vikunja: Scoped API token can mint unrestricted OAuth session credentials * 8.1 — 2026-10-10
CVE-2026-91985 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash < 2.6.0 8.7 — 2026-09-16
CVE-2026-91984 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position < 2.6.0 5.3 — 2026-09-16
CVE-2026-91982 Vikunja before 2.6.0 TOTP Secret Disclosure via API < 2.6.0 5.3 — 2026-09-16
CVE-2026-91983 Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter ≥ 1.0.0 < 2.6.0 5.3 — 2026-09-16
CVE-2026-91981 Vikunja before 2.6.0 User Enumeration via v2 API < 2.6.0 5.3 — 2026-09-16
CVE-2026-91979 Vikunja before 2.6.0 Denial of Service via Decompression Bomb < 2.6.0 7.1 — 2026-09-16
CVE-2026-91980 vikunja before 2.6.0 Team Enumeration via Project Share < 2.6.0 5.3 — 2026-09-16
CVE-2026-91973 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth < 2.6.0 8.7 — 2026-09-16
CVE-2026-91972 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API < 2.6.0 8.7 — 2026-09-16
CVE-2026-91971 Vikunja before 2.6.0 Denial of Service via Avatar Upload < 2.6.0 7.1 — 2026-09-16
CVE-2026-91970 Vikunja before 2.6.0 Resource Exhaustion via Planka Migration < 2.6.0 7.1 — 2026-09-16
公式サイト ソースコード SolutionMarket の掲載ページ

自社サーバーでこれらのバージョンを追跡

InfraGuard はすべてのサーバーからインストール済みソフトウェアのバージョンを収集し、既知の脆弱性があるものを通知します。セルフホスト型なので、データがネットワーク外に出ることはありません。

ライブデモを試す 今すぐ購入

悪用された脆弱性の週刊ダイジェスト

セルフホスト型サーバーに関係する KEV の追加情報を週1回お届けします。それ以外のメールは送りません。

データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。