Vulnerabilities in go-vikunja
105 resultsCVE-2026-33313MEDIUMVikunja has an IDOR in Task Comments Allows Reading Arbitrary CommentsEPSS 0.3%CVE-2026-123509MEDIUMVikunja before 2.7.1 Denial of Service via Unbounded Kanban Bucket CountEPSS 0.3%CVE-2026-123514MEDIUMVikunja before 2.7.1 Orphaned Export Archives Enable Disk ExhaustionEPSS 0.3%CVE-2026-123511MEDIUMVikunja before 2.7.1 Resource Exhaustion via CalDAV VTODO RELATED-TO EntriesEPSS 0.3%CVE-2026-123512HIGHVikunja before 2.7.1 Sensitive Token Exposure via URL Query in Access LogsEPSS 0.3%CVE-2026-91984MEDIUMVikunja before 2.6.0 Broken Object-Level Authorization via task-positionEPSS 0.3%CVE-2026-123530MEDIUMVikunja before 2.7.1 Missing Step-Up Authentication via TOTP Enrollment EndpointsEPSS 0.3%CVE-2026-33700MEDIUMVikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share DeletionEPSS 0.3%CVE-2026-25935HIGHVikunja Affected by XSS Via Task PreviewEPSS 0.3%CVE-2026-33335MEDIUMVikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternalEPSS 0.3%CVE-2026-27116MEDIUMVikunja has Reflected HTML Injection via filter Parameter in Projects ModuleEPSS 0.3%CVE-2026-123526MEDIUMVikunja before 2.7.1 Mass Assignment via Team external_id FieldEPSS 0.3%CVE-2026-123513HIGHVikunja before 2.7.1 Auth Token Leak via API URL ChangeEPSS 0.3%CVE-2026-123503MEDIUMVikunja before 2.7.1 Improper Authorization in Kanban Bucket DeletionEPSS 0.2%CVE-2026-123527MEDIUMVikunja 2.4.0 before 2.7.1 API Token Scope Collision Authorization BypassEPSS 0.2%CVE-2026-123521MEDIUMVikunja before 2.7.1 Password Brute-Force via TOTP Disable EndpointEPSS 0.2%CVE-2026-123528HIGHVikunja before 2.7.1 Insufficient Session Expiration via HTTP Token MiddlewareEPSS 0.2%CVE-2026-123502MEDIUMVikunja before 2.7.1 Link-Share Hash Exposure via Request Path LoggingEPSS 0.2%CVE-2026-123493MEDIUMVikunja from 2.4.0 before 2.7.1 Authentication Bypass via Bot API TokensEPSS 0.2%CVE-2026-40103MEDIUMVikunja's Scoped API tokens with projects.background permission can delete project backgroundsEPSS 0.2%