Vikunja records

35 published records for vendor vikunja.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 2
With a fix record: 65.7%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

35 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
39Monitor	CVE-2026-28268No exploit	Vikunja Vulnerable to Account Takeover via Password Reset Token Reusevikunja · vikunja · CWE-459 Pre-auth	Critical9.8	—	0.9%	Feb 27, 2026
36Monitor	CVE-2026-27575No exploit	Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Changevikunja · vikunja · CWE-521 Pre-auth	Critical9.1	—	0.4%	Feb 25, 2026
36Monitor	CVE-2026-34727No exploit	Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Pathvikunja · vikunja · CWE-287 Pre-auth Auth bypass	Critical9.1	—	0.4%	Apr 10, 2026
34Monitor	CVE-2026-25935No exploit	Vikunja Affected by XSS Via Task Previewvikunja · vikunja · CWE-80 Pre-auth XSS	High8.6	—	0.3%	Feb 11, 2026
33Monitor	CVE-2026-35595No exploit	Vikunja Affected by Privilege Escalation via Project Reparentingvikunja · vikunja · CWE-269	High8.3	—	0.4%	Apr 10, 2026
32Monitor	CVE-2026-33316No exploit	Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablementvikunja · vikunja · CWE-284 Broken access control (IDOR)	High8.1	—	0.4%	Mar 24, 2026
32Monitor	CVE-2026-33678No exploit	Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletionvikunja · vikunja · CWE-639 Broken access control (IDOR)	High8.1	—	0.3%	Mar 24, 2026
30Monitor	CVE-2026-35597No exploit	Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockoutvikunja · vikunja · CWE-307 Pre-auth	High7.5	—	0.4%	Apr 10, 2026
29Monitor	CVE-2026-27616No exploit	Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposurevikunja · vikunja · CWE-79 XSS	High7.3	—	0.6%	Feb 25, 2026
29Monitor	CVE-2026-33679No exploit	Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protectionsvikunja · vikunja · CWE-918 SSRF	High7.4	—	0.4%	Mar 24, 2026
28Monitor	CVE-2026-27819No exploit	Vikunja has Path Traversal in CLI Restorevikunja · vikunja · CWE-22 Path traversal	High7.2	—	0.8%	Feb 25, 2026
28Monitor	CVE-2026-33668No exploit	Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connectvikunja · vikunja · CWE-285 Broken access control (IDOR)	High7.1	—	0.6%	Mar 24, 2026
28Monitor	CVE-2026-35602No exploit	Vikunja has a File Size Limit Bypass via Vikunja Importvikunja · vikunja · CWE-770 Denial of service	High7.1	—	0.5%	Apr 10, 2026
27Monitor	CVE-2026-33315No exploit	Vikunja has a 2FA Bypass via Caldav Basic Authvikunja · vikunja · CWE-288 Pre-auth Auth bypass	Medium6.9	—	0.4%	Mar 24, 2026
27Monitor	CVE-2026-33700No exploit	Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletionvikunja · vikunja · CWE-639 Broken access control (IDOR)	Medium6.9	—	0.3%	Mar 24, 2026
26Monitor	CVE-2026-33336No exploit	Vikunja Desktop vulnerable to Remote Code Execution via same-window navigationvikunja · vikunja · CWE-94 pre-auth RCE	Medium6.5	—	0.9%	Mar 24, 2026
26Monitor	CVE-2026-33334No exploit	Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegrationvikunja · vikunja · CWE-94 pre-auth RCE XSS	Medium6.5	—	0.7%	Mar 24, 2026
26Monitor	CVE-2026-35599No exploit	Vikunja has an Algorithmic Complexity DoS in Repeating Task Handlervikunja · vikunja · CWE-407 Denial of service	Medium6.5	—	0.5%	Apr 10, 2026
26Monitor	CVE-2026-33474No exploit	Vikunja Affected by DoS via Image Preview Generationvikunja · vikunja · CWE-400 Denial of service	Medium6.5	—	0.4%	Mar 24, 2026
26Monitor	CVE-2026-33680No exploit	Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalationvikunja · vikunja · CWE-285 Broken access control (IDOR)	Medium6.5	—	0.4%	Mar 24, 2026
26Monitor	CVE-2026-35594No exploit	Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgradevikunja · vikunja · CWE-613 Pre-auth	Medium6.5	—	0.4%	Apr 10, 2026
26Monitor	CVE-2026-33676No exploit	Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Readvikunja · vikunja · CWE-863 Broken access control (IDOR)	Medium6.5	—	0.4%	Mar 24, 2026
26Monitor	CVE-2026-33677No exploit	Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via APIvikunja · vikunja · CWE-200 Info leak	Medium6.5	—	0.4%	Mar 24, 2026
25Monitor	CVE-2026-33335No exploit	Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternalvikunja · vikunja · CWE-939	Medium6.4	—	0.3%	Mar 24, 2026
24Monitor	CVE-2026-27116No exploit	Vikunja has Reflected HTML Injection via filter Parameter in Projects Modulevikunja · vikunja · CWE-79 Pre-auth XSS	Medium6.1	—	0.2%	Feb 25, 2026

CVE-2026-28268
39Monitor
Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse
CriticalCVSS 9.8No exploitEPSS 0%
- Pre-auth
vikunja · vikunjaFeb 27, 2026
CVE-2026-27575
36Monitor
Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
vikunja · vikunjaFeb 25, 2026
CVE-2026-34727
36Monitor
Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path
CriticalCVSS 9.1No exploitEPSS 0%
- Pre-auth
- Auth bypass
vikunja · vikunjaApr 10, 2026
CVE-2026-25935
34Monitor
Vikunja Affected by XSS Via Task Preview
HighCVSS 8.6No exploitEPSS 0%
- Pre-auth
- XSS
vikunja · vikunjaFeb 11, 2026
CVE-2026-35595
33Monitor
Vikunja Affected by Privilege Escalation via Project Reparenting
HighCVSS 8.3No exploitEPSS 0%
vikunja · vikunjaApr 10, 2026
CVE-2026-33316
32Monitor
Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
vikunja · vikunjaMar 24, 2026
CVE-2026-33678
32Monitor
Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion
HighCVSS 8.1No exploitEPSS 0%
- Broken access control (IDOR)
vikunja · vikunjaMar 24, 2026
CVE-2026-35597
30Monitor
Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
vikunja · vikunjaApr 10, 2026
CVE-2026-27616
29Monitor
Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure
HighCVSS 7.3No exploitEPSS 0%
- XSS
vikunja · vikunjaFeb 25, 2026
CVE-2026-33679
29Monitor
Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections
HighCVSS 7.4No exploitEPSS 0%
- SSRF
vikunja · vikunjaMar 24, 2026
CVE-2026-27819
28Monitor
Vikunja has Path Traversal in CLI Restore
HighCVSS 7.2No exploitEPSS 0%
- Path traversal
vikunja · vikunjaFeb 25, 2026
CVE-2026-33668
28Monitor
Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect
HighCVSS 7.1No exploitEPSS 0%
- Broken access control (IDOR)
vikunja · vikunjaMar 24, 2026
CVE-2026-35602
28Monitor
Vikunja has a File Size Limit Bypass via Vikunja Import
HighCVSS 7.1No exploitEPSS 0%
- Denial of service
vikunja · vikunjaApr 10, 2026
CVE-2026-33315
27Monitor
Vikunja has a 2FA Bypass via Caldav Basic Auth
MediumCVSS 6.9No exploitEPSS 0%
- Pre-auth
- Auth bypass
vikunja · vikunjaMar 24, 2026
CVE-2026-33700
27Monitor
Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion
MediumCVSS 6.9No exploitEPSS 0%
- Broken access control (IDOR)
vikunja · vikunjaMar 24, 2026
CVE-2026-33336
26Monitor
Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation
MediumCVSS 6.5No exploitEPSS 0%
- pre-auth RCE
vikunja · vikunjaMar 24, 2026
CVE-2026-33334
26Monitor
Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration
MediumCVSS 6.5No exploitEPSS 0%
- pre-auth RCE
- XSS
vikunja · vikunjaMar 24, 2026
CVE-2026-35599
26Monitor
Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler
MediumCVSS 6.5No exploitEPSS 0%
- Denial of service
vikunja · vikunjaApr 10, 2026
CVE-2026-33474
26Monitor
Vikunja Affected by DoS via Image Preview Generation
MediumCVSS 6.5No exploitEPSS 0%
- Denial of service
vikunja · vikunjaMar 24, 2026
CVE-2026-33680
26Monitor
Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation
MediumCVSS 6.5No exploitEPSS 0%
- Broken access control (IDOR)
vikunja · vikunjaMar 24, 2026
CVE-2026-35594
26Monitor
Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade
MediumCVSS 6.5No exploitEPSS 0%
- Pre-auth
vikunja · vikunjaApr 10, 2026
CVE-2026-33676
26Monitor
Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read
MediumCVSS 6.5No exploitEPSS 0%
- Broken access control (IDOR)
vikunja · vikunjaMar 24, 2026
CVE-2026-33677
26Monitor
Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API
MediumCVSS 6.5No exploitEPSS 0%
- Info leak
vikunja · vikunjaMar 24, 2026
CVE-2026-33335
25Monitor
Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal
MediumCVSS 6.4No exploitEPSS 0%
vikunja · vikunjaMar 24, 2026
CVE-2026-27116
24Monitor
Vikunja has Reflected HTML Injection via filter Parameter in Projects Module
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
vikunja · vikunjaFeb 25, 2026