Read the docs

wekan

Records60All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical6CVSS 9.0–10.0
CVSS high24CVSS 7.0–8.9

Exploited now

wekan records in CISA KEV

No wekan vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Wekan 39 records HIGH

Records

39 records in Wekan · all components

TI-2026-20667 CVE-2026-25560 · GHSA-gmrw-vh4q-4fvv

WeKan < 8.19 LDAP Authentication Filter Injection

Priority MEDIUM 47

WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00732 Published 2026-02-07 Fixed in 8.19 CWE-90
TI-2026-20903 CVE-2026-25859 · GHSA-gp3c-fxmq-6r3c

WeKan < 8.20 Migration Functionality Insufficient Permission Checks

Priority LOW 31

Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unauthorized migration operations.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00381 Published 2026-02-07 Fixed in 8.20 CWE-863
TI-2026-20675 CVE-2026-25568 · GHSA-mxjf-259r-3r76

WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass

Priority LOW 31

WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforced at board creation time.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00225 Published 2026-02-07 Fixed in 8.19 CWE-863
TI-2026-20672 CVE-2026-25565 · GHSA-7c8j-xhpq-ww8c

WeKan < 8.19 Read-only Board Roles Can Update Cards

Priority LOW 31

WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring write permission.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00307 Published 2026-02-07 Fixed in 8.19 CWE-863
TI-2026-20670 CVE-2026-25563 · GHSA-x9cj-242h-gr3m

WeKan < 8.19 Checklist Creation Cross-Board IDOR

Priority LOW 31

WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00314 Published 2026-02-07 Fixed in 8.19 CWE-639
TI-2026-20669 CVE-2026-25562 · GHSA-4h56-xmq8-7hc9

WeKan < 8.19 Attachments Publication Information Disclosure

Priority LOW 30

WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00321 Published 2026-02-07 Fixed in 8.19 CWE-203
TI-2018-15945 CVE-2018-1000549 · GHSA-6pcr-7gwm-4pc7

Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register'…

Priority LOW 27

Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker could perform a brute force attack to obtain valid usernames…

CVSS 3.0MEDIUM 5.3 Network No auth No interaction EPSS 0.01281 Published 2018-06-26 No fix listed CWE-200
TI-2021-03881 CVE-2021-20654 · GHSA-p4j3-3c38-6j6r

Cross-site scripting in Wekan

Priority LOW 26

Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scripting.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.0076 Published 2021-02-10 No fix listed CWE-79
Load more
Open these records in search →