Export limit exceeded: 203743 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (203743 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-123527 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.4 Medium |
| Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform unintended operations due to colliding v1 and v2 API token permission keys. Attackers with a token scoped to read project backgrounds can delete them via the v2 DELETE background route, and bucket create-only tokens can update existing buckets. | ||||
| CVE-2026-123526 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.4 Medium |
| Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only external_id field through the team create and update endpoints. Attackers can tag a team they create or administer as externally managed, permanently blocking removal of every member and causing SSO members to be dropped from the team at their next login. | ||||
| CVE-2026-123525 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.5 Medium |
| Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers, which buffer remote attachment downloads and API responses in memory without size caps. Authenticated users can start a migration that references huge attacker-served attachments or yields oversized API responses, exhausting memory and crashing the shared API process for all tenants. | ||||
| CVE-2026-123523 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.5 Medium |
| Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to exhaust server memory by requesting avatars at many distinct sizes. Attackers can upload a noisy avatar and fetch it at each size up to 1024, caching roughly a gigabyte per account without eviction and causing the API process to be OOM-killed. | ||||
| CVE-2026-123522 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 7.1 High |
| Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object into a no-op Kanban bucket move. Attackers can set task.id to a victim task and task.project_id to their own project, routing full task contents to their webhook and forging mention notifications. | ||||
| CVE-2026-123521 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.9 Medium |
| Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to brute-force account passwords via unthrottled re-authentication endpoints. Attackers with a stolen session can guess the password via /user/settings/totp/disable without lockout, then disable TOTP without a code for persistent account takeover. | ||||
| CVE-2026-123519 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.5 Medium |
| Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a ~22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the wekan migrate endpoint, triggering OOM and crashing the instance. | ||||
| CVE-2026-123517 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.3 Medium |
| Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members/{own username} for arbitrary team ids and use the distinguishable responses to learn if a team exists, is SSO-managed, or has a single member. | ||||
| CVE-2026-123516 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.3 Medium |
| Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the per-entry caps, forcing scanArchive to process every entry twice. | ||||
| CVE-2026-123515 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.1 Medium |
| Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content. | ||||
| CVE-2026-123514 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.3 Medium |
| Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exports, failed exports, or account deletion. Authenticated users can repeatedly re-trigger exports containing all their attachments to exhaust disk storage, while deleted users' personal data remains retained indefinitely. | ||||
| CVE-2026-123513 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.8 Medium |
| Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, the bearer token and desktop OAuth refresh token are sent to the attacker's server, enabling account takeover. | ||||
| CVE-2026-123512 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 6.1 Medium |
| Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string of emailed links, so the full request URI, including the token, is written to Vikunja's HTTP access log and any reverse-proxy logs when a user clicks the link. Attackers with read access to those logs can replay an unredeemed password-reset token to take over the account or an account-deletion token to confirm the deletion. | ||||
| CVE-2026-123511 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.3 Medium |
| Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV clients to create unbounded dummy tasks by sending VTODOs with thousands of RELATED-TO properties. Attackers can repeat unknown related UIDs in a single PUT request to generate thousands of task, relation, and event rows, bloating the database and overloading the event pipeline. | ||||
| CVE-2026-123510 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 3.3 Low |
| Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log. | ||||
| CVE-2026-123509 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.3 Medium |
| Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows project writers or view admins to create unlimited kanban buckets due to missing count caps. Attackers can create thousands of buckets so every kanban read runs a task SELECT and COUNT per bucket, generating heavy database load. | ||||
| CVE-2026-123507 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 2.7 Low |
| Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break project views by saving a filter-mode bucket configuration with a null filter. Because validateProjectViewFilters skips nil entries, every subsequent read of the view panics in kanban and task collection code, returning HTTP 500 to all project members. | ||||
| CVE-2026-123506 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.4 Medium |
| Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped only to projects_webhooks to manage the owner's user-level webhooks by supplying user_id in request bodies. Attackers can register user webhooks to their own receiver to obtain reminders and task payloads from all owner projects, and read, change or delete existing user webhooks. | ||||
| CVE-2026-123505 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 5.5 Medium |
| Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data because localStorage.Write creates blobs world-readable. Local attackers on a shared host can read attachments, project backgrounds and exports, and copy the SQLite database to crack password hashes offline. | ||||
| CVE-2026-123504 | 1 Vikunja | 1 Vikunja | 2026-11-08 | 4.3 Medium |
| Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members to view full webhook target URLs by listing project webhooks. Attackers can extract incoming-webhook tokens or API keys embedded in target_url values to post to receiving channels or reuse keys until rotated. | ||||