| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|---|---|---|---|
| CVE-2026-123522 | 7.1 | Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by injecting a crafted task object into a no-op Kanban bucket move. Attackers can set task.id to a victim task and task.project_id to | 2026-11-08 02:16:41 | 2026-11-08 02:16:41 |
| CVE-2026-123521 | 5.9 | Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows session holders to brute-force account passwords via unthrottled re-authentication endpoints. Attackers with a stolen session can gue | 2026-11-08 02:16:41 | 2026-11-08 02:16:41 |
| CVE-2026-123520 | 7.1 | Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or ownership of read-only shared projects by deleting accounts. Attackers can create a bot, add it to their team, and delete it throu | 2026-11-08 02:16:41 | 2026-11-08 02:16:41 |
| CVE-2026-123519 | 6.5 | Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a ~22 MB WeKan JSON with hundreds of | 2026-11-08 02:16:41 | 2026-11-08 02:16:41 |
| CVE-2026-123518 | 4.3 | Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write access to the bucket's project and to the task separately but never verifies that both belong to the same project. Authenticated users | 2026-11-08 02:16:41 | 2026-11-08 02:16:40 |
| CVE-2026-123517 | 4.3 | Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine whether private teams exist by calling the team member self-removal endpoint. Attackers can send DELETE requests to /teams/{id}/members | 2026-11-08 02:16:40 | 2026-11-08 02:16:40 |
| CVE-2026-123516 | 4.3 | Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing man | 2026-11-08 02:16:40 | 2026-11-08 02:16:40 |
| CVE-2026-123515 | 4.1 | Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers' clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, commen | 2026-11-08 02:16:40 | 2026-11-08 02:16:40 |
| CVE-2026-123514 | 4.3 | Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned on disk after re-exports, failed exports, or account deletion. Authenticated users can repeatedly re-trigger exports containing al | 2026-11-08 02:16:40 | 2026-11-08 02:16:40 |
| CVE-2026-123513 | 6.8 | Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by inducing users to switch the frontend API URL. Because checkAndSetApiUrl leaves origin-independent localStorage tokens in place, th | 2026-11-08 02:16:40 | 2026-11-08 02:16:40 |
| ID | CVSS | Sažetak | Zadnje ažurirano | Objavljeno |
|---|
Stranica
/39953
Zapisa po stranici: