go-vikunja vulnerabilities

Newest CVEs

• CVE-2026-115507

  Vikunja 2.2.0 before 2.7.1 HTML Injection via Notification Email Header

  go-vikunja · vikunja

  Medium5.1
• CVE-2026-111922

  Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins

  go-vikunja · vikunja

  High7.2
• CVE-2026-111921

  Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion

  go-vikunja · vikunja

  Medium5.3
• CVE-2026-111920

  Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions

  go-vikunja · vikunja

  Medium5.3
• CVE-2026-111919

  Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks

  go-vikunja · vikunja

  High7.1
• CVE-2026-111918

  Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation

  go-vikunja · vikunja

  Medium5.3
• CVE-2026-111917

  Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation

  go-vikunja · vikunja

  High7.1
• CVE-2026-62376

  Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access

  go-vikunja · vikunja

  High8.1
• CVE-2026-62367

  Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

  go-vikunja · vikunja

  High7.5
• CVE-2026-57458

  Vikunja: Scoped API token can mint unrestricted OAuth session credentials

  go-vikunja · vikunja

  High8.1