wekan

Records60All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high24CVSS 7.0–8.9

Exploited now

wekan records in CISA KEV

No wekan vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Wekan 39 records HIGH

Records

60 records

TI-2026-40177 CVE-2026-55652

Improper authentication in wekan

HIGH 82

Wekan is open source kanban built with Meteor.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0062 Published 2026-07-15 Fixed in 9.46 CWE-287

TI-2026-37989 CVE-2026-52893

Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook

HIGH 81

Wekan is open source kanban built with Meteor.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0048 Published 2026-07-15 Fixed in 9.32 CWE-287

TI-2026-48308 CVE-2026-68561

Improper privilege management in wekan

HIGH 73

Wekan is open source kanban built with Meteor.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00506 Published 2026-08-19 Fixed in 9.89 CWE-269

TI-2026-48305 CVE-2026-68558

Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)

HIGH 70

Wekan is open source kanban built with Meteor.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00388 Published 2026-08-19 Fixed in 9.74 CWE-918

TI-2026-39911 CVE-2026-55234

Improper access control in wekan

HIGH 70

Wekan is open source kanban built with Meteor.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00425 Published 2026-07-15 Fixed in 9.37 CWE-284

TI-2026-01855 CVE-2026-2207 · GHSA-p69q-x7rq-85qp

WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure

HIGH 70

A weakness has been identified in WeKan up to 8.20.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00407 Published 2026-02-08 Fixed in 8.21 CWE-200

TI-2026-38525 CVE-2026-53444

Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin

HIGH 68

Wekan is open source kanban built with Meteor.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00414 Published 2026-07-15 Fixed in 9.32 CWE-269

TI-2026-48455 CVE-2026-68900

Wekan: Stored XSS in HTML board exports through a card-title second parse

HIGH 66

Wekan is open source kanban built with Meteor.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.0035 Published 2026-08-19 Fixed in 10.23 CWE-79

TI-2026-38526 CVE-2026-53445

Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards

MEDIUM 64

Wekan is open source kanban built with Meteor.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00414 Published 2026-07-15 Fixed in 9.32 CWE-862

TI-2026-37986 CVE-2026-52890

Wekan: Arbitrary file read and server DoS via attachment versions.original.path

MEDIUM 64

Wekan is open source kanban built with Meteor.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00476 Published 2026-07-15 Fixed in 9.31 CWE-22

TI-2026-83217 CVE-2026-119300

Regular expression denial of service in Wekan user search

MEDIUM 62

Wekan is open source kanban built with Meteor.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00295 Published 2026-10-30 Fixed in 11.11 CWE-1333

TI-2026-48456 CVE-2026-68901

NULL pointer dereference in wekan

MEDIUM 62

Wekan is open source kanban built with Meteor.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0053 Published 2026-08-19 Fixed in 10.38 CWE-476

TI-2026-48306 CVE-2026-68559

Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)

MEDIUM 62

Wekan is open source kanban built with Meteor.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00402 Published 2026-08-19 Fixed in 9.74 CWE-639

TI-2026-38528 CVE-2026-53447

Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID

MEDIUM 62

Wekan is open source kanban built with Meteor.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00402 Published 2026-07-15 Fixed in 9.35 CWE-639

TI-2023-13025 CVE-2023-28485 · GHSA-69jw-68vm-vprw

A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before…

MEDIUM 58

A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00965 Published 2023-06-26 No fix listed CWE-79

TI-2026-20667 CVE-2026-25560 · GHSA-gmrw-vh4q-4fvv

WeKan < 8.19 LDAP Authentication Filter Injection

MEDIUM 47

WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00732 Published 2026-02-07 Fixed in 8.19 CWE-90

TI-2026-37987 CVE-2026-52891

Wekan: Shell Injection via Avatar Upload

MEDIUM 44

Wekan is open source kanban built with Meteor.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00785 Published 2026-07-15 Fixed in 9.07 CWE-78

TI-2026-23675 CVE-2026-30846

Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication

MEDIUM 44

Wekan is an open source kanban tool built with Meteor.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00392 Published 2026-03-06 Fixed in 8.34 CWE-200

TI-2026-23673 CVE-2026-30844

Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading

MEDIUM 42

Wekan is an open source kanban tool built with Meteor.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00268 Published 2026-03-06 Fixed in 8.34 CWE-918

TI-2026-23672 CVE-2026-30843

Wekan has Cross-Board IDOR in Custom Fields Update Endpoints

MEDIUM 42

Wekan is an open source kanban tool built with Meteor.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00248 Published 2026-03-06 Fixed in 8.34 CWE-639

TI-2025-40439 CVE-2025-65781 · GHSA-j27j-25gc-gv9v

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15…

MEDIUM 42

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16.

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.00342 Published 2025-12-15 No fix listed CWE-287

TI-2026-48454 CVE-2026-68899

Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback

MEDIUM 40

Wekan is open source kanban built with Meteor.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00527 Published 2026-08-19 Fixed in 9.90 CWE-434

TI-2026-23676 CVE-2026-30847

Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens

MEDIUM 40

Wekan is an open source kanban tool built with Meteor.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00268 Published 2026-03-06 Fixed in 8.34 CWE-200

TI-2025-40438 CVE-2025-65780 · GHSA-qpmv-4x3r-fmxw

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15…

MEDIUM 40

An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00337 Published 2025-12-15 No fix listed CWE-284

TI-2026-30043 CVE-2026-41454 · GHSA-f2hf-mr43-85mv

WeKan < 8.35 Missing Authorization via Integration REST API

LOW 39

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-22 Fixed in 8.35.0 CWE-862

Open these records in search →

Critical	6
High	24
Medium	29
Low	1
No CVSS	0