Vulnerabilities

TI-2026-83217 CVE-2026-119300

Regular expression denial of service in Wekan user search

MEDIUM 62

Wekan is open source kanban built with Meteor.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00295 Published 2026-10-30 Fixed in 11.11 CWE-1333

TI-2026-48456 CVE-2026-68901

NULL pointer dereference in wekan

MEDIUM 62

Wekan is open source kanban built with Meteor.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.0053 Published 2026-08-19 Fixed in 10.38 CWE-476

TI-2026-48455 CVE-2026-68900

Wekan: Stored XSS in HTML board exports through a card-title second parse

HIGH 66

Wekan is open source kanban built with Meteor.

CVSS 3.1HIGH 7.6 Network Low privileges User interaction EPSS 0.0035 Published 2026-08-19 Fixed in 10.23 CWE-79

TI-2026-48454 CVE-2026-68899

Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback

MEDIUM 40

Wekan is open source kanban built with Meteor.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00527 Published 2026-08-19 Fixed in 9.90 CWE-434

TI-2026-48308 CVE-2026-68561

Improper privilege management in wekan

HIGH 73

Wekan is open source kanban built with Meteor.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00506 Published 2026-08-19 Fixed in 9.89 CWE-269

TI-2026-48307 CVE-2026-68560

Wekan:hell Injection in External Antivirus Scanner Path via asyncExec

LOW 36

Wekan is open source kanban built with Meteor.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.00584 Published 2026-08-19 Fixed in 9.75 CWE-78

TI-2026-48305 CVE-2026-68558

Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)

HIGH 70

Wekan is open source kanban built with Meteor.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00388 Published 2026-08-19 Fixed in 9.74 CWE-918

TI-2026-48306 CVE-2026-68559

Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)

MEDIUM 62

Wekan is open source kanban built with Meteor.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00402 Published 2026-08-19 Fixed in 9.74 CWE-639

TI-2026-40177 CVE-2026-55652

Improper authentication in wekan

HIGH 82

Wekan is open source kanban built with Meteor.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0062 Published 2026-07-15 Fixed in 9.46 CWE-287

TI-2026-39911 CVE-2026-55234

Improper access control in wekan

HIGH 70

Wekan is open source kanban built with Meteor.

CVSS 3.1HIGH 8.5 Network Low privileges No interaction EPSS 0.00425 Published 2026-07-15 Fixed in 9.37 CWE-284

TI-2026-38528 CVE-2026-53447

Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID

MEDIUM 62

Wekan is open source kanban built with Meteor.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00402 Published 2026-07-15 Fixed in 9.35 CWE-639

TI-2026-37989 CVE-2026-52893

Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hook

HIGH 81

Wekan is open source kanban built with Meteor.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.0048 Published 2026-07-15 Fixed in 9.32 CWE-287

TI-2026-38525 CVE-2026-53444

Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin

HIGH 68

Wekan is open source kanban built with Meteor.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00414 Published 2026-07-15 Fixed in 9.32 CWE-269

TI-2026-38526 CVE-2026-53445

Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards

MEDIUM 64

Wekan is open source kanban built with Meteor.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00414 Published 2026-07-15 Fixed in 9.32 CWE-862

TI-2026-38527 CVE-2026-53446

Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLs

LOW 28

Wekan is open source kanban built with Meteor.

CVSS 4.0MEDIUM 6.2 Network High privileges No interaction EPSS 0.00498 Published 2026-07-15 Fixed in 9.32 CWE-918

TI-2026-37988 CVE-2026-52892

Missing authorization in wekan

LOW 29

Wekan is open source kanban built with Meteor.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00463 Published 2026-07-15 Fixed in 9.32 CWE-862

TI-2026-37987 CVE-2026-52891

Wekan: Shell Injection via Avatar Upload

MEDIUM 44

Wekan is open source kanban built with Meteor.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00785 Published 2026-07-15 Fixed in 9.07 CWE-78

TI-2026-37986 CVE-2026-52890

Wekan: Arbitrary file read and server DoS via attachment versions.original.path

MEDIUM 64

Wekan is open source kanban built with Meteor.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00476 Published 2026-07-15 Fixed in 9.31 CWE-22

TI-2026-42320 CVE-2026-59154

Wekan: Checklist direct DDP updates can write checklist data into private boards

LOW 20

Wekan is open source kanban built with Meteor.

CVSS 3.1MEDIUM 4.3 Network Low privileges No interaction EPSS 0.00358 Published 2026-07-10 Fixed in 9.64 CWE-863

TI-2026-30044 CVE-2026-41455 · GHSA-qvhh-2f8h-hqgp

WeKan < 8.35 SSRF via Webhook URL

LOW 28

WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL scheme field accepts any string without protocol restriction or destination validation.

CVSS 4.0MEDIUM 6.3 Network Low privileges No interaction EPSS 0.00236 Published 2026-04-22 Fixed in 8.35.0 CWE-918

TI-2026-30043 CVE-2026-41454 · GHSA-f2hf-mr43-85mv

WeKan < 8.35 Missing Authorization via Integration REST API

LOW 39

WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform administrative actions without proper privilege verification.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00274 Published 2026-04-22 Fixed in 8.35.0 CWE-862

TI-2026-23676 CVE-2026-30847

Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens

MEDIUM 40

Wekan is an open source kanban tool built with Meteor.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00268 Published 2026-03-06 Fixed in 8.34 CWE-200

TI-2026-23675 CVE-2026-30846

Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication

MEDIUM 44

Wekan is an open source kanban tool built with Meteor.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00392 Published 2026-03-06 Fixed in 8.34 CWE-200

TI-2026-23674 CVE-2026-30845

Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication

LOW 36

Wekan is an open source kanban tool built with Meteor.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00337 Published 2026-03-06 Fixed in 8.34 CWE-200

TI-2026-23673 CVE-2026-30844

Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading

MEDIUM 42

Wekan is an open source kanban tool built with Meteor.

CVSS 4.0CRITICAL 9.3 Network Low privileges No interaction EPSS 0.00268 Published 2026-03-06 Fixed in 8.34 CWE-918

Vulnerabilities

Filters