Browse All CVEs
50,426 vulnerabilities.
| CVE | Severity | CVSS | EPSS | First Seen | Flags | Description |
|---|---|---|---|---|---|---|
CVE-2026-123525 |
high | 7.1 | 0.0031 | 2026-11-08 | Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft | |
CVE-2026-123524 |
medium | 6.9 | 0.0031 | 2026-11-08 | Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that all | |
CVE-2026-123523 |
high | 7.1 | 0.0031 | 2026-11-08 | Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allo | |
CVE-2026-123522 |
high | 7.1 | 0.0031 | 2026-11-08 | Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authentica | |
CVE-2026-123521 |
medium | 6.0 | 0.0024 | 2026-11-08 | Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts | |
CVE-2026-123520 |
high | 7.1 | 0.0030 | 2026-11-08 | Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows | |
CVE-2026-123519 |
high | 7.1 | 0.0031 | 2026-11-08 | Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated | |
CVE-2026-123518 |
medium | 5.3 | 0.0019 | 2026-11-08 | Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUp | |
CVE-2026-123517 |
high | 7.1 | 0.0022 | 2026-11-08 | Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenti | |
CVE-2026-123516 |
high | 7.1 | 0.0030 | 2026-11-08 | Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP | |
CVE-2026-123515 |
medium | 5.1 | 0.0017 | 2026-11-08 | Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows user | |
CVE-2026-123514 |
medium | 5.3 | 0.0027 | 2026-11-08 | Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full- | |
CVE-2026-123513 |
high | 7.6 | 0.0025 | 2026-11-08 | Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to | |
CVE-2026-123512 |
high | 8.4 | 0.0027 | 2026-11-08 | Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion t | |
CVE-2026-123511 |
medium | 5.3 | 0.0027 | 2026-11-08 | Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allo | |
CVE-2026-123510 |
low | 1.0 | 0.0009 | 2026-11-08 | Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowi | |
CVE-2026-123509 |
medium | 5.3 | 0.0027 | 2026-11-08 | Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allo | |
CVE-2026-123508 |
low | 2.0 | 0.0009 | 2026-11-08 | Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets tha | |
CVE-2026-123507 |
medium | 5.1 | 0.0029 | 2026-11-08 | Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that all | |
CVE-2026-123506 |
medium | 5.3 | 0.0021 | 2026-11-08 | Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows | |
CVE-2026-123505 |
medium | 6.8 | 0.0010 | 2026-11-08 | Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local | |
CVE-2026-123504 |
medium | 5.3 | 0.0022 | 2026-11-08 | Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that all | |
CVE-2026-123503 |
medium | 5.3 | 0.0024 | 2026-11-08 | Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that | |
CVE-2026-123502 |
medium | 6.9 | 0.0023 | 2026-11-08 | Vikunja before 2.7.1 contains an information exposure vulnerability that allows log reader | |
CVE-2026-123501 |
high | 7.1 | 0.0031 | 2026-11-08 | Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allo | |
CVE-2026-123500 |
medium | 6.9 | 0.0012 | 2026-11-08 | Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local | |
CVE-2026-123499 |
medium | 6.0 | 0.0011 | 2026-11-08 | Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malici | |
CVE-2026-123498 |
low | 2.1 | 0.0015 | 2026-11-08 | Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project m | |
CVE-2026-123497 |
high | 7.6 | 0.0016 | 2026-11-08 | Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates | |
CVE-2026-123496 |
medium | 4.8 | 0.0013 | 2026-11-08 | Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attacker | |
CVE-2026-123495 |
medium | 5.1 | 0.0010 | 2026-11-08 | Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callb | |
CVE-2026-123494 |
medium | 5.1 | 0.0010 | 2026-11-08 | Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attac | |
CVE-2026-123493 |
medium | 5.3 | 0.0023 | 2026-11-08 | Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allow | |
CVE-2025-34653 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34652 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34650 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34649 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34648 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34647 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34646 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34645 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34644 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34643 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34642 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34641 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34640 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34639 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34605 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34603 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne | |
CVE-2025-34602 |
— | — | — | 2026-11-08 | Rejected reason: This CVE ID was rejected because it was reserved but not used for a vulne |