Search
320 CVEs · published 2026-11-08 to 2026-11-08
CVEs (320)
Showing 1–25 of 320
| CVE ID | Severity | Patch | CVSS | Published ↑ | Description |
|---|---|---|---|---|---|
| CVE-2026-123493 | MEDIUM | Patched | 5.4 | 2026-11-08 | Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to retain access through API tokens owned by their bot … |
| CVE-2026-123494 | MEDIUM | Patched | 3.5 | 2026-11-08 | Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft T… |
| CVE-2026-123495 | MEDIUM | Patched | 4.6 | 2026-11-08 | Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or Origin checks, enabling login cross-site request for… |
| CVE-2026-123496 | MEDIUM | Patched | 3.3 | 2026-11-08 | Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks.… |
| CVE-2026-123497 | HIGH | Patched | 6.8 | 2026-11-08 | Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. At… |
| CVE-2026-123498 | LOW | Patched | 3.7 | 2026-11-08 | Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task … |
| CVE-2026-123499 | MEDIUM | Patched | 5.9 | 2026-11-08 | Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to capture API tokens by specifying an attacker-controlled … |
| CVE-2026-123500 | MEDIUM | Patched | 6.2 | 2026-11-08 | Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask permissions by the vikunja dump co… |
| CVE-2026-123501 | HIGH | Patched | 6.5 | 2026-11-08 | Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory through concurrent image decodes i… |
| CVE-2026-123502 | MEDIUM | Patched | 5.2 | 2026-11-08 | Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes because the request logger records the raw URI of th… |
| CVE-2026-123503 | MEDIUM | Patched | 5.4 | 2026-11-08 | Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project write access to delete buckets via a mismatched view ID.… |
| CVE-2026-123504 | MEDIUM | Patched | 4.3 | 2026-11-08 | Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project … |
| CVE-2026-123505 | MEDIUM | Patched | 5.5 | 2026-11-08 | Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable… |
| CVE-2026-123506 | MEDIUM | Patched | 5.4 | 2026-11-08 | Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-lev… |
| CVE-2026-123507 | MEDIUM | Patched | 2.7 | 2026-11-08 | Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configura… |
| CVE-2026-123508 | LOW | Patched | 3.1 | 2026-11-08 | Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers wh… |
| CVE-2026-123509 | MEDIUM | Patched | 4.3 | 2026-11-08 | Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows project writers or view admins to create unlimited kanban buckets due to missin… |
| CVE-2026-123510 | LOW | Patched | 3.3 | 2026-11-08 | Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. L… |
| CVE-2026-123511 | MEDIUM | Patched | 4.3 | 2026-11-08 | Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV clients to create unbounded dummy tasks by sending VTODOs … |
| CVE-2026-123512 | HIGH | Patched | 6.1 | 2026-11-08 | Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so the full request URI, including… |
| CVE-2026-123513 | HIGH | Patched | 6.8 | 2026-11-08 | Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Becaus… |
| CVE-2026-123514 | MEDIUM | Patched | 4.3 | 2026-11-08 | Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exports, failed exports, or account… |
| CVE-2026-123515 | MEDIUM | Patched | 4.1 | 2026-11-08 | Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by … |
| CVE-2026-123516 | HIGH | Patched | 4.3 | 2026-11-08 | Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading ar… |
| CVE-2026-123517 | HIGH | Patched | 4.3 | 2026-11-08 | Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member se… |