Vulnerabilidades en go-vikunja

56 resultados
Análisis Vexday

Go-Vikunja apresenta 35 vulnerabilidades catalogadas, das quais 2 são críticas, mas nenhuma está sendo explorada ativamente no cenário atual. A fraqueza dominante (CWE-863 - falha de autorização inadequada) sugere problemas de controle de acesso, exigindo revisão de políticas de permissão. O risco é de moderado a baixo no curto prazo pela ausência de exploração ativa, embora a quantidade de vulnerabilidades demande atenção preventiva.

CVE-2026-40103MEDIUMVikunja's Scoped API tokens with projects.background permission can delete project backgroundsEPSS 0.3%CVE-2026-35598MEDIUMVikunja has Missing Authorization on CalDAV Task ReadEPSS 0.3%CVE-2026-35596MEDIUMVikunja has Broken Access Control on Label Read via SQL Operator Precedence BugEPSS 0.3%CVE-2026-91982MEDIUMVikunja before 2.6.0 TOTP Secret Disclosure via APIEPSS 0.3%CVE-2026-33700MEDIUMVikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share DeletionEPSS 0.3%CVE-2026-55067MEDIUMVikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignmentEPSS 0.3%CVE-2026-25935HIGHVikunja Affected by XSS Via Task PreviewEPSS 0.3%CVE-2026-33313MEDIUMVikunja has an IDOR in Task Comments Allows Reading Arbitrary CommentsEPSS 0.3%CVE-2026-35601MEDIUMVikunja has an iCalendar Property Injection via CRLF in CalDAV Task OutputEPSS 0.3%CVE-2026-35600MEDIUMVikunja has HTML Injection via Task Titles in Overdue Email NotificationsEPSS 0.3%CVE-2026-33312MEDIUMRead-only Vikunja users can delete project background images via broken object-level authorizationEPSS 0.3%CVE-2026-91980MEDIUMvikunja before 2.6.0 Team Enumeration via Project ShareEPSS 0.3%CVE-2026-91981MEDIUMVikunja before 2.6.0 User Enumeration via v2 APIEPSS 0.3%CVE-2026-91983MEDIUMVikunja before 2.6.0 API Token Scope Bypass via expand ParameterEPSS 0.3%CVE-2026-27116MEDIUMVikunja has Reflected HTML Injection via filter Parameter in Projects ModuleEPSS 0.3%CVE-2026-91984MEDIUMVikunja before 2.6.0 Broken Object-Level Authorization via task-positionEPSS 0.3%