2.2 に影響するCVE
| CVE | タイトル | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|
| CVE-2026-68582 | Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token | 9.3 | — | 2026-08-02 | |
| CVE-2026-91972 | Vikunja before 2.6.0 Authentication Bypass via Unthrottled API | 8.7 | — | 2026-09-16 | |
| CVE-2026-91973 | Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth | 8.7 | — | 2026-09-16 | |
| CVE-2026-91985 | Vikunja before 2.6.0 Privilege Escalation via Link Share Hash | 8.7 | — | 2026-09-16 | |
| CVE-2026-123531 | Vikunja 1.0.0 before 2.7.1 Pagination Limit Bypass via page=0 Parameter | 8.7 | — | 2026-11-08 | |
| CVE-2026-68581 | Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision | 8.6 | — | 2026-08-02 | |
| CVE-2026-123512 | Vikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access Logs | 8.4 | — | 2026-11-08 | |
| CVE-2026-76216 | Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing | 7.7 | — | 2026-08-19 | |
| CVE-2026-123528 | Vikunja before 2.7.1 Insufficient Session Expiration via HTTP Token Middleware | 7.6 | — | 2026-11-08 | |
| CVE-2026-123497 | Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery | 7.6 | — | 2026-11-08 | |
| CVE-2026-123513 | Vikunja before 2.7.1 Auth Token Leak via API URL Change | 7.6 | — | 2026-11-08 | |
| CVE-2026-111922 | Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins | 7.2 | — | 2026-10-18 | |
| CVE-2026-123522 | Vikunja before 2.7.1 Task Information Disclosure via Kanban Bucket Move Webhook | 7.1 | — | 2026-11-08 | |
| CVE-2026-111919 | Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks | 7.1 | — | 2026-10-18 | |
| CVE-2026-123517 | Vikunja before 2.7.1 Information Disclosure via Team Self-Removal Endpoint | 7.1 | — | 2026-11-08 | |
| CVE-2026-123523 | Vikunja before 2.7.1 Memory Exhaustion via Unbounded Avatar Size Cache | 7.1 | — | 2026-11-08 | |
| CVE-2026-123520 | Vikunja 0.18.0 before 2.7.1 Privilege Escalation via Account Deletion | 7.1 | — | 2026-11-08 | |
| CVE-2026-123516 | Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import | 7.1 | — | 2026-11-08 | |
| CVE-2026-123519 | Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports | 7.1 | — | 2026-11-08 | |
| CVE-2026-123525 | Vikunja before 2.7.1 Memory Exhaustion DoS via Trello, Todoist and Microsoft To Do Migrations | 7.1 | — | 2026-11-08 | |
| CVE-2026-123501 | Vikunja before 2.7.1 Memory Exhaustion DoS via Unbounded Image Decodes | 7.1 | — | 2026-11-08 | |
| CVE-2026-91970 | Vikunja before 2.6.0 Resource Exhaustion via Planka Migration | 7.1 | — | 2026-09-16 | |
| CVE-2026-91971 | Vikunja before 2.6.0 Denial of Service via Avatar Upload | 7.1 | — | 2026-09-16 | |
| CVE-2026-91979 | Vikunja before 2.6.0 Denial of Service via Decompression Bomb | 7.1 | — | 2026-09-16 | |
| CVE-2026-123500 | Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump | 6.9 | — | 2026-11-08 | |
| CVE-2026-123524 | Vikunja 0.23.0 before 2.7.1 Information Disclosure via Webhook related_tasks Payload | 6.9 | — | 2026-11-08 | |
| CVE-2026-123502 | Vikunja before 2.7.1 Link-Share Hash Exposure via Request Path Logging | 6.9 | — | 2026-11-08 | |
| CVE-2026-123505 | Vikunja before 2.7.1 World-Readable Local File Storage and SQLite Database | 6.8 | — | 2026-11-08 | |
| CVE-2026-123521 | Vikunja before 2.7.1 Password Brute-Force via TOTP Disable Endpoint | 6.0 | — | 2026-11-08 | |
| CVE-2026-123499 | Vikunja veans before 2.7.1 Credential Leak via Repo-Controlled .veans.yml Server | 6.0 | — | 2026-11-08 | |
| CVE-2026-123530 | Vikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment Endpoints | 6.0 | — | 2026-11-08 | |
| CVE-2026-123518 | Vikunja before 2.7.1 Missing Authorization in Kanban Task-Bucket Move | 5.3 | — | 2026-11-08 | |
| CVE-2026-91980 | vikunja before 2.6.0 Team Enumeration via Project Share | 5.3 | — | 2026-09-16 | |
| CVE-2026-123509 | Vikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket Count | 5.3 | — | 2026-11-08 | |
| CVE-2026-111918 | Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation | 5.3 | — | 2026-10-18 | |
| CVE-2026-91984 | Vikunja before 2.6.0 Broken Object-Level Authorization via task-position | 5.3 | — | 2026-09-16 | |
| CVE-2026-91982 | Vikunja before 2.6.0 TOTP Secret Disclosure via API | 5.3 | — | 2026-09-16 | |
| CVE-2026-123514 | Vikunja before 2.7.1 Orphaned Export Archives Enable Disk Exhaustion | 5.3 | — | 2026-11-08 | |
| CVE-2026-123511 | Vikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO Entries | 5.3 | — | 2026-11-08 | |
| CVE-2026-123526 | Vikunja before 2.7.1 Mass Assignment via Team external_id Field | 5.3 | — | 2026-11-08 | |
| CVE-2026-123506 | Vikunja 2.2.0 before 2.7.1 Token Scope Bypass via Project Webhook Endpoints | 5.3 | — | 2026-11-08 | |
| CVE-2026-123504 | Vikunja 0.22.0 before 2.7.1 Webhook URL Credential Exposure to Read-Only Members | 5.3 | — | 2026-11-08 | |
| CVE-2026-123503 | Vikunja before 2.7.1 Improper Authorization in Kanban Bucket Deletion | 5.3 | — | 2026-11-08 | |
| CVE-2026-111921 | Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion | 5.3 | — | 2026-10-18 | |
| CVE-2026-91983 | Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter | 5.3 | — | 2026-09-16 | |
| CVE-2026-91981 | Vikunja before 2.6.0 User Enumeration via v2 API | 5.3 | — | 2026-09-16 | |
| CVE-2026-123529 | Vikunja before 2.7.1 Stored CSS Injection via TipTap Table Cell data-background-color | 5.1 | — | 2026-11-08 | |
| CVE-2026-123494 | Vikunja before 2.7.1 Login CSRF via Migration OAuth Callbacks | 5.1 | — | 2026-11-08 | |
| CVE-2026-123515 | Vikunja before 2.7.1 Client-Side Request Forgery via Stored Rich-Text Images | 5.1 | — | 2026-11-08 | |
| CVE-2026-123507 | Vikunja 0.24.0 before 2.7.1 Denial of Service via Nil Bucket Filter | 5.1 | — | 2026-11-08 | |
| CVE-2026-115507 | Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header | 5.1 | — | 2026-10-23 | |
| CVE-2026-123495 | Vikunja 2.0.0 before 2.7.1 Login CSRF via /api/v2 Login and OIDC Callback | 5.1 | — | 2026-11-08 | |
| CVE-2026-123496 | Vikunja veans before 2.7.1 Symlink Following in veans init | 4.8 | — | 2026-11-08 | |
| CVE-2026-123498 | Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata | 2.1 | — | 2026-11-08 | |
| CVE-2026-123508 | Vikunja before 2.7.1 Supply Chain Risk via Unpinned xgo Release Toolchain | 2.0 | — | 2026-11-08 | |
| CVE-2026-123510 | Vikunja before 2.7.1 Plugin and Log Directories Not Anchored to Rootpath | 1.0 | — | 2026-11-08 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。