Vulnerabilidades en go-vikunja
56 resultadosAnálisis Vexday
Go-Vikunja apresenta 35 vulnerabilidades catalogadas, das quais 2 são críticas, mas nenhuma está sendo explorada ativamente no cenário atual. A fraqueza dominante (CWE-863 - falha de autorização inadequada) sugere problemas de controle de acesso, exigindo revisão de políticas de permissão. O risco é de moderado a baixo no curto prazo pela ausência de exploração ativa, embora a quantidade de vulnerabilidades demande atenção preventiva.
CVE-2026-33315MEDIUMVikunja has a 2FA Bypass via Caldav Basic AuthEPSS 0.4%CVE-2026-33316HIGHVikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account DisablementEPSS 0.4%CVE-2026-91970HIGHVikunja before 2.6.0 Resource Exhaustion via Planka MigrationEPSS 0.4%CVE-2026-91968HIGHvikunja before 2.6.0 Denial of Service via unbounded filter recursionEPSS 0.4%CVE-2026-91969HIGHvikunja before 2.6.0 Resource Exhaustion via CSV MigrationEPSS 0.4%CVE-2026-91971HIGHVikunja before 2.6.0 Denial of Service via Avatar UploadEPSS 0.4%CVE-2026-91979HIGHVikunja before 2.6.0 Denial of Service via Decompression BombEPSS 0.4%CVE-2026-91985HIGHVikunja before 2.6.0 Privilege Escalation via Link Share HashEPSS 0.4%CVE-2026-54766MEDIUMVikunja: Project duplication bypasses write-permission check on the target parent projectEPSS 0.4%CVE-2026-33676MEDIUMVikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task ReadEPSS 0.4%CVE-2026-34727HIGHVikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login PathEPSS 0.4%CVE-2026-33677MEDIUMWebhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via APIEPSS 0.4%CVE-2026-33675MEDIUMVikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network ResourcesEPSS 0.4%CVE-2026-33678HIGHVikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and DeletionEPSS 0.4%CVE-2026-33335MEDIUMVikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternalEPSS 0.4%CVE-2026-33473MEDIUMVikunja has TOTP Reuse During Validity WindowEPSS 0.4%CVE-2026-55066HIGHVikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_idEPSS 0.4%CVE-2026-55064MEDIUMVikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0EPSS 0.4%CVE-2026-76216HIGHVikunja through 2.4.0 Principal-Type Confusion via LinkSharingEPSS 0.4%CVE-2026-68582CRITICALVikunja 0.24.0 Broken Object Level Authorization via Link-Share TokenEPSS 0.4%