Vikunja

Vikunja

40 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
4.3

CVE-2026-33315

Exploit
  • EPSS 0.3%
  • Veröffentlicht 24.03.2026 14:53:34
  • Zuletzt bearbeitet 24.03.2026 19:21:46

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, the Caldav endpoint allows login using Basic Authentication, which in turn allows users to bypass the TOTP on 2FA-enabled accounts. The user can then access stand...

4.3

CVE-2026-33313

  • EPSS 0.25%
  • Veröffentlicht 24.03.2026 14:50:11
  • Zuletzt bearbeitet 24.03.2026 19:21:12

Vikunja is an open-source self-hosted task management platform. Prior to version 2.2.0, an authenticated user can read any task comment by ID, regardless of whether they have access to the task the comment belongs to, by substituting the task ID in t...

5.4

CVE-2026-33312

Exploit
  • EPSS 0.21%
  • Veröffentlicht 20.03.2026 14:42:14
  • Zuletzt bearbeitet 24.03.2026 21:17:38

Vikunja is an open-source self-hosted task management platform. Starting in version 0.20.2 and prior to version 2.2.0, the `DELETE /api/v1/projects/:project/background` endpoint checks `CanRead` permission instead of `CanUpdate`, allowing any user wi...

5.3

CVE-2026-29794

Exploit
  • EPSS 0.33%
  • Veröffentlicht 20.03.2026 14:39:59
  • Zuletzt bearbeitet 24.03.2026 21:18:04

Vikunja is an open-source self-hosted task management platform. Starting in version 0.8 and prior to version 2.2.0, unauthenticated users are able to bypass the application's built-in rate-limits by spoofing the `X-Forwarded-For` or `X-Real-IP` heade...

9.8

CVE-2026-28268

  • EPSS 0.67%
  • Veröffentlicht 27.02.2026 20:16:29
  • Zuletzt bearbeitet 06.03.2026 21:03:09

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.1.0 have a business logic vulnerability exists in the password reset mechanism of vikunja/api that allows password reset tokens to be reused indefinitely. Due to a fa...

7.2

CVE-2026-27819

Exploit
  • EPSS 0.74%
  • Veröffentlicht 25.02.2026 21:40:38
  • Zuletzt bearbeitet 05.03.2026 16:32:00

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the restoreConfig function in vikunja/pkg/modules/dump/restore.go of the go-vikunja/vikunja repository fails to sanitize file paths within the provided ZIP archiv...

7.3

CVE-2026-27616

Exploit
  • EPSS 0.45%
  • Veröffentlicht 25.02.2026 21:37:57
  • Zuletzt bearbeitet 05.03.2026 16:35:10

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to upload SVG files as task attachments. SVG is an XML-based format that supports JavaScript execution through elements such as <scri...

9.1

CVE-2026-27575

Exploit
  • EPSS 0.43%
  • Veröffentlicht 25.02.2026 21:35:23
  • Zuletzt bearbeitet 05.03.2026 17:21:37

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, the application allows users to set weak passwords (e.g., 1234, password) without enforcing minimum strength requirements. Additionally, active sessions remain va...

6.1

CVE-2026-27116

Exploit
  • EPSS 0.22%
  • Veröffentlicht 25.02.2026 21:33:50
  • Zuletzt bearbeitet 05.03.2026 17:22:12

Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulnerability exists in the Projects module where the `filter` URL parameter is rendered into the DOM without output encoding when the ...

5.4

CVE-2026-25935

  • EPSS 0.23%
  • Veröffentlicht 11.02.2026 20:47:53
  • Zuletzt bearbeitet 20.02.2026 20:17:54

Vikunja is a todo-app to organize your life. Prior to 1.1.0, TaskGlanceTooltip.vue temporarily creates a div and sets the innerHtml to the description. Since there is no escaping on either the server or client side, a malicious user can share a proje...