go-vikunja

Records67All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical5CVSS 9.0–10.0

CVSS high29CVSS 7.0–8.9

Exploited now

go-vikunja records in CISA KEV

No go-vikunja vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Vikunja 35 records HIGH

Records

35 records in Vikunja · all components

TI-2026-21967 CVE-2026-27575 · GHSA-3ccg-x393-96v8

Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change

HIGH 80

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00473 Published 2026-02-25 Fixed in 2.0.0 CWE-521

TI-2026-26971 CVE-2026-34727 · GHSA-8jvc-mcx6-r4cg

Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path

HIGH 74

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00292 Published 2026-04-10 Fixed in 2.3.0 CWE-287

TI-2026-26060 CVE-2026-33680 · GHSA-8hp8-9fhr-pfm9

Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation

HIGH 72

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00405 Published 2026-03-24 Fixed in 2.2.2 CWE-285

TI-2026-20965 CVE-2026-25935 · GHSA-m4g2-2q66-vc9v

Vikunja Affected by XSS Via Task Preview

HIGH 72

Vikunja is a todo-app to organize your life.

CVSS 4.0HIGH 8.6 Network No auth User interaction EPSS 0.00259 Published 2026-02-11 Fixed in 1.1.0 CWE-80

TI-2026-27698 CVE-2026-35595 · GHSA-2vq4-854f-5c72

Vikunja Affected by Privilege Escalation via Project Reparenting

HIGH 71

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 8.3 Network Low privileges No interaction EPSS 0.00295 Published 2026-04-10 Fixed in 2.3.0 CWE-269

TI-2026-25727 CVE-2026-33316 · GHSA-vq4q-79hh-q767

Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement

HIGH 70

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00377 Published 2026-03-24 Fixed in 2.2.0 CWE-284

TI-2026-25726 CVE-2026-33315 · GHSA-47cr-f226-r4pq

Vikunja has a 2FA Bypass via Caldav Basic Auth

HIGH 70

Vikunja is an open-source self-hosted task management platform.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00314 Published 2026-03-24 Fixed in 2.2.0 CWE-288

TI-2026-27697 CVE-2026-35594 · GHSA-96q5-xm3p-7m84

Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

HIGH 68

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00317 Published 2026-04-10 Fixed in 2.3.0 CWE-613

TI-2026-22171 CVE-2026-27819 · GHSA-42wg-38gx-85rh

Vikunja has Path Traversal in CLI Restore

HIGH 67

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00832 Published 2026-02-25 Fixed in 2.0.0 CWE-22

TI-2026-27700 CVE-2026-35597 · GHSA-fgfv-pv97-6cmj

Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout

HIGH 66

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00308 Published 2026-04-10 Fixed in 2.3.0 CWE-307

TI-2026-26059 CVE-2026-33679 · GHSA-g9xj-752q-xh63

Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections

HIGH 66

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 7.4 Network Low privileges No interaction EPSS 0.00402 Published 2026-03-24 Fixed in 2.2.1 CWE-918

TI-2026-22002 CVE-2026-27616 · GHSA-7jp5-298q-jg98

Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure

HIGH 65

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00512 Published 2026-02-25 Fixed in 2.0.0 CWE-79

TI-2026-27705 CVE-2026-35602 · GHSA-qh78-rvg3-cv54

Vikunja has a File Size Limit Bypass via Vikunja Import

MEDIUM 64

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00351 Published 2026-04-10 Fixed in 2.3.0 CWE-770

TI-2026-25746 CVE-2026-33336

Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation

MEDIUM 64

Vikunja is an open-source self-hosted task management platform.

CVSS 4.0MEDIUM 6.5 Network No auth User interaction EPSS 0.01159 Published 2026-03-24 Fixed in 2.2.0 CWE-94

TI-2026-23380 CVE-2026-29794 · GHSA-m547-hp4w-j6jx

Vikunja has Rate-Limit Bypass for Unauthenticated Users via Spoofed Headers

MEDIUM 63

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00349 Published 2026-03-20 Fixed in 2.2.0 CWE-807

TI-2026-27702 CVE-2026-35599 · GHSA-r4fg-73rc-hhh7

Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler

MEDIUM 62

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00361 Published 2026-04-10 Fixed in 2.3.0 CWE-407

TI-2026-26057 CVE-2026-33677 · GHSA-7c2g-p23p-4jg3

Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API

MEDIUM 62

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00302 Published 2026-03-24 Fixed in 2.2.1 CWE-200

TI-2026-26056 CVE-2026-33676 · GHSA-8cmm-j6c4-rr8v

Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read

MEDIUM 62

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00362 Published 2026-03-24 Fixed in 2.2.1 CWE-863

TI-2026-26055 CVE-2026-33675 · GHSA-g66v-54v9-52pr

Vikunja has SSRF via Todoist/Trello Migration File Attachment URLs that Allows Reading Internal Network Resources

MEDIUM 62

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00277 Published 2026-03-24 Fixed in 2.2.1 CWE-918

TI-2026-25870 CVE-2026-33474 · GHSA-wc83-79hj-hpmq

Vikunja Affected by DoS via Image Preview Generation

MEDIUM 62

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00324 Published 2026-03-24 Fixed in 2.2.0 CWE-400

TI-2026-25745 CVE-2026-33335

Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal

MEDIUM 62

Vikunja is an open-source self-hosted task management platform.

CVSS 4.0MEDIUM 6.4 Network Low privileges User interaction EPSS 0.00257 Published 2026-03-24 Fixed in 2.2.0 CWE-939

TI-2026-21568 CVE-2026-27116 · GHSA-4qgr-4h56-8895

Vikunja has Reflected HTML Injection via filter Parameter in Projects Module

MEDIUM 60

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00257 Published 2026-02-25 Fixed in 2.0.0 CWE-79

TI-2026-25869 CVE-2026-33473 · GHSA-p747-qc5p-773r

Vikunja has TOTP Reuse During Validity Window

MEDIUM 59

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.00325 Published 2026-03-24 Fixed in 2.2.1 CWE-287

TI-2026-28929 CVE-2026-40103 · GHSA-v479-vf79-mg83

Vikunja's Scoped API tokens with projects.background permission can delete project backgrounds

MEDIUM 58

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00226 Published 2026-04-10 Fixed in 2.3.0 CWE-836

TI-2026-27703 CVE-2026-35600 · GHSA-45q4-x4r9-8fqj

Vikunja has HTML Injection via Task Titles in Overdue Email Notifications

MEDIUM 58

Vikunja is an open-source self-hosted task management platform.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00202 Published 2026-04-10 Fixed in 2.3.0 CWE-79

Open these records in search →