wekan vulnerabilities

Newest CVEs

• CVE-2026-119300

  Wekan: ReDoS via Unescaped User Input in RegExp

  wekan · wekan

  Medium6.5
• CVE-2026-68901

  WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service

  wekan · wekan

  Medium6.5
• CVE-2026-68900

  Wekan: Stored XSS in HTML board exports through a card-title second parse

  wekan · wekan

  High7.6
• CVE-2026-68899

  Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback

  wekan · wekan

  High8.7
• CVE-2026-68561

  Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule

  wekan · wekan

  High8.8
• CVE-2026-68560

  Wekan:hell Injection in External Antivirus Scanner Path via asyncExec

  wekan · wekan

  High7.7
• CVE-2026-68558

  Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)

  wekan · wekan

  High8.5
• CVE-2026-68559

  Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)

  wekan · wekan

  Medium6.5
• CVE-2026-55652

  Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)

  wekan · wekan

  Critical9.8
• CVE-2026-55234

  Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)

  wekan · wekan

  High8.5