CVEs we hold for Go-vikunja
Records whose assigning authority named Go-vikunja as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-91984Vikunja before 2.6.0 Broken Object-Level Authorization via task-positiongo-vikunja vikunja
CVE-2026-91968vikunja before 2.6.0 Denial of Service via unbounded filter recursiongo-vikunja vikunja
CVE-2026-68582Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Tokengo-vikunja vikunja
CVE-2026-68581Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collisiongo-vikunja vikunja
CVE-2026-55067Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignmentgo-vikunja vikunja
CVE-2026-55066Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_idgo-vikunja vikunja
CVE-2026-55065Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/apigo-vikunja vikunja
CVE-2026-55064Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via…go-vikunja vikunja
CVE-2026-54766Vikunja: Project duplication bypasses write-permission check on the target parent projectgo-vikunja vikunja
CVE-2026-40103Vikunja's Scoped API tokens with projects.background permission can delete project backgroundsgo-vikunja vikunja
CVE-2026-35601Vikunja has an iCalendar Property Injection via CRLF in CalDAV Task Outputgo-vikunja vikunja
CVE-2026-35600Vikunja has HTML Injection via Task Titles in Overdue Email Notificationsgo-vikunja vikunja
CVE-2026-35597Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockoutgo-vikunja vikunja
CVE-2026-35596Vikunja has Broken Access Control on Label Read via SQL Operator Precedence Buggo-vikunja vikunja
CVE-2026-35594Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgradego-vikunja vikunja
CVE-2026-34727Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Pathgo-vikunja vikunja
CVE-2026-33700Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletiongo-vikunja vikunja
CVE-2026-33680Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalationgo-vikunja vikunja
CVE-2026-33679Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protectionsgo-vikunja vikunja
CVE-2026-33678Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletiongo-vikunja vikunja
CVE-2026-33677Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via APIgo-vikunja vikunja
CVE-2026-33676Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Readgo-vikunja vikunja
CVE-2026-33675Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resourcesgo-vikunja vikunja
CVE-2026-33668Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connectgo-vikunja vikunja
CVE-2026-33336Vikunja Desktop vulnerable to Remote Code Execution via same-window navigationgo-vikunja vikunja
CVE-2026-33335Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternalgo-vikunja vikunja
CVE-2026-33334Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegrationgo-vikunja vikunja
CVE-2026-33316Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablementgo-vikunja vikunja
CVE-2026-33313Vikunja has an IDOR in Task Comments Allows Reading Arbitrary Commentsgo-vikunja vikunja
CVE-2026-33312Read-only Vikunja users can delete project background images via broken object-level authorizationgo-vikunja vikunja
CVE-2026-29794Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headersgo-vikunja vikunja
CVE-2026-28268Vikunja Vulnerable to Account Takeover via Password Reset Token Reusego-vikunja vikunja
CVE-2026-27616Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposurego-vikunja vikunja
CVE-2026-27575Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Changego-vikunja vikunja
CVE-2026-27116Vikunja has Reflected HTML Injection via filter Parameter in Projects Modulego-vikunja vikunja
56 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.