Browse CVEs

MEDIUM 5.4 CVE-2026-40103 Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's scoped API token enforcement for custom project background … Vikunja 2.3.0+ Fix from $1,6002026-04-10 HIGH 7.5 CVE-2026-35597 Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the TOTP failed-attempt lockout mechanism is non-functional due to a … Vikunja 2.3.0+ Fix from $1,9502026-04-10 HIGH 7.1 CVE-2026-35602 Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the Vikunja file import endpoint uses the attacker-controlled Size fi… Vikunja 2.3.0+ Fix from $1,9502026-04-10 MEDIUM 6.5 CVE-2026-35599 Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the addRepeatIntervalToTime function uses an O(n) loop that advances … Vikunja 2.3.0+ Fix from $1,6002026-04-10 MEDIUM 5.4 CVE-2026-35600 Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, task titles are embedded directly into Markdown link syntax in overdu… Vikunja 2.3.0+ Fix from $1,6002026-04-10 HIGH 8.3 CVE-2026-35595 Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CanUpdate check at pkg/models/project_permissions.go:139-148 only… Vikunja 2.3.0+ Fix from $1,9502026-04-10 MEDIUM 6.5 CVE-2026-35594 Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, Vikunja's link share authentication (GetLinkShareFromClaims in pkg/mo… Vikunja 2.3.0+ Fix from $1,6002026-04-10 CRITICAL 9.1 CVE-2026-34727 Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the OIDC callback handler issues a full JWT token without checking wh… Vikunja 2.3.0+ Fix from $2,3002026-04-10 HIGH 8.1 CVE-2026-33678 Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, `TaskAttachment.ReadOne()` queries attachments by ID only (`W… Vikunja 2.2.1+ Fix from $1,9502026-03-24 HIGH 7.4 CVE-2026-33679 Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `DownloadImage` function in `pkg/utils/avatar.go` uses a … Vikunja 2.2.1+ Fix from $1,9502026-03-24 MEDIUM 6.5 CVE-2026-33677 Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the `GET /api/v1/projects/:project/webhooks` endpoint returns… Vikunja 2.2.1+ Fix from $1,6002026-03-24 MEDIUM 6.5 CVE-2026-33680 Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.2, the `LinkSharing.ReadAll()` method allows link share authenti… Vikunja 2.2.2+ Fix from $1,6002026-03-24 HIGH 8.1 CVE-2026-33668 Vikunja is an open-source self-hosted task management platform. Starting in version 0.18.0 and prior to version 2.2.1, when a user account is disable… Vikunja 2.2.1+ Fix from $1,9502026-03-24 MEDIUM 6.5 CVE-2026-33676 Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, when the Vikunja API returns tasks, it populates the `related… Vikunja 2.2.1+ Fix from $1,6002026-03-24 MEDIUM 5.4 CVE-2026-33675 Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.1, the migration helper functions `DownloadFile` and `DownloadFi… Vikunja 2.2.1+ Fix from $1,6002026-03-24 CRITICAL 9.6 CVE-2026-33334 Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron w… Vikunja 2.2.2+ Fix from $2,3002026-03-24 HIGH 8.8 CVE-2026-33336 Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron w… Vikunja 2.2.2+ Fix from $1,9502026-03-24 HIGH 8.0 CVE-2026-33335 Vikunja is an open-source self-hosted task management platform. Starting in version 0.21.0 and prior to version 2.2.0, the Vikunja Desktop Electron w… Vikunja 2.2.2+ Fix from $1,9502026-03-24 MEDIUM 6.5 CVE-2026-33474 Vikunja is an open-source self-hosted task management platform. Starting in version 1.0.0-rc0 and prior to version 2.2.0, unbounded image decoding an… Vikunja 2.2.0+ Fix from $1,6002026-03-24 MEDIUM 5.7 CVE-2026-33473 Vikunja is an open-source self-hosted task management platform. Starting in version 0.13 and prior to version 2.2.1, any user that has enabled 2FA ca… Vikunja 2.2.1+ Fix from $1,6002026-03-24 HIGH 8.1 CVE-2026-33316 Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, a flaw in Vikunja’s password reset logic allows disabled user… Vikunja 2.2.0+ Fix from $1,9502026-03-24 MEDIUM 5.4 CVE-2026-33312 Vikunja is an open-source self-hosted task management platform. Starting in version 0.20.2 and prior to version 2.2.0, the `DELETE /api/v1/projects/:… Vikunja 2.2.0+ Fix from $1,6002026-03-20 MEDIUM 5.3 CVE-2026-29794 Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unauthenticated users are able to… Vikunja 2.2.0+ Fix from $1,6002026-03-20 CRITICAL 9.8 CVE-2026-28268 Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password re… Vikunja 2.1.0+ Fix from $2,3002026-02-27 HIGH 7.2 CVE-2026-27819 Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restor… Vikunja 2.0.0+ Fix from $1,9502026-02-25 CRITICAL 9.1 CVE-2026-27575 Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 123… Vikunja 2.0.0+ Fix from $2,3002026-02-25 HIGH 7.3 CVE-2026-27616 Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to upload SVG files as task atta… Vikunja 2.0.0+ Fix from $1,9502026-02-25 MEDIUM 6.1 CVE-2026-27116 Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulnerability exists in the Projec… Vikunja 2.0.0+ Fix from $1,6002026-02-25 MEDIUM 5.4 CVE-2026-25935 Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the descriptio… Vikunja 1.1.0+ Fix from $1,6002026-02-11