İçeriğe atla
Noroxi

Vikunja kayıtları

vikunja üreticisine ait 35 yayımlanmış kayıt.

Araştırmacı profili

KEV’e giren
0 · %0
Silahlaştırılmış
0 · %0
Pre-auth RCE
2
Düzeltme kaydı olan
%65,7
Yayından KEV’e ortanca
KEV’e giren kayıt yok

Yıllara göre kayıt

  1. 26

Çubuk: toplam · koyu kısım: CISA KEV.

Tekrar eden sınıflar

Bu üreticide en sık görülen zafiyet sınıfları: nereye bakmalı.

CWE

Saldırı profili

Tüm kayıtlar

35 kayıt
  • CVE-2026-28268
    39İzleyin

    Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse

    KritikCVSS 9,8İstismar yokEPSS %1

    vikunja · vikunja27 Şub 2026

  • CVE-2026-27575
    36İzleyin

    Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change

    KritikCVSS 9,1İstismar yokEPSS %0

    vikunja · vikunja25 Şub 2026

  • CVE-2026-34727
    36İzleyin

    Vikunja ahs a TOTP Two-Factor Authentication Bypass via OIDC Login Path

    KritikCVSS 9,1İstismar yokEPSS %0

    vikunja · vikunja10 Nis 2026

  • CVE-2026-25935
    34İzleyin

    Vikunja Affected by XSS Via Task Preview

    YüksekCVSS 8,6İstismar yokEPSS %0

    vikunja · vikunja11 Şub 2026

  • CVE-2026-35595
    33İzleyin

    Vikunja Affected by Privilege Escalation via Project Reparenting

    YüksekCVSS 8,3İstismar yokEPSS %0

    vikunja · vikunja10 Nis 2026

  • CVE-2026-33316
    32İzleyin

    Vikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement

    YüksekCVSS 8,1İstismar yokEPSS %0

    vikunja · vikunja24 Mar 2026

  • CVE-2026-33678
    32İzleyin

    Vikunja has IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion

    YüksekCVSS 8,1İstismar yokEPSS %0

    vikunja · vikunja24 Mar 2026

  • CVE-2026-35597
    30İzleyin

    Vikunja Affected by TOTP Brute-Force Due to Non-Functional Account Lockout

    YüksekCVSS 7,5İstismar yokEPSS %0

    vikunja · vikunja10 Nis 2026

  • CVE-2026-27616
    29İzleyin

    Vikunja Vulnerable to Stored Cross-Site Scripting (XSS) via Unsanitized SVG Attachment Upload Leading to Token Exposure

    YüksekCVSS 7,3İstismar yokEPSS %1

    vikunja · vikunja25 Şub 2026

  • CVE-2026-33679
    29İzleyin

    Vikunja has SSRF via OpenID Connect Avatar Download that Bypasses Webhook SSRF Protections

    YüksekCVSS 7,4İstismar yokEPSS %0

    vikunja · vikunja24 Mar 2026

  • CVE-2026-27819
    28İzleyin

    Vikunja has Path Traversal in CLI Restore

    YüksekCVSS 7,2İstismar yokEPSS %1

    vikunja · vikunja25 Şub 2026

  • CVE-2026-33668
    28İzleyin

    Vikunja Allows Disabled/Locked User Accounts to Authenticate via API Tokens, CalDAV, and OpenID Connect

    YüksekCVSS 7,1İstismar yokEPSS %1

    vikunja · vikunja24 Mar 2026

  • CVE-2026-35602
    28İzleyin

    Vikunja has a File Size Limit Bypass via Vikunja Import

    YüksekCVSS 7,1İstismar yokEPSS %1

    vikunja · vikunja10 Nis 2026

  • CVE-2026-33315
    27İzleyin

    Vikunja has a 2FA Bypass via Caldav Basic Auth

    OrtaCVSS 6,9İstismar yokEPSS %0

    vikunja · vikunja24 Mar 2026

  • CVE-2026-33700
    27İzleyin

    Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share Deletion

    OrtaCVSS 6,9İstismar yokEPSS %0

    vikunja · vikunja24 Mar 2026

  • CVE-2026-33336
    26İzleyin

    Vikunja Desktop vulnerable to Remote Code Execution via same-window navigation

    OrtaCVSS 6,5İstismar yokEPSS %1

    vikunja · vikunja24 Mar 2026

  • CVE-2026-33334
    26İzleyin

    Vikunja Desktop: Any frontend XSS escalates to Remote Code Execution due to nodeIntegration

    OrtaCVSS 6,5İstismar yokEPSS %1

    vikunja · vikunja24 Mar 2026

  • CVE-2026-35599
    26İzleyin

    Vikunja has an Algorithmic Complexity DoS in Repeating Task Handler

    OrtaCVSS 6,5İstismar yokEPSS %1

    vikunja · vikunja10 Nis 2026

  • CVE-2026-33474
    26İzleyin

    Vikunja Affected by DoS via Image Preview Generation

    OrtaCVSS 6,5İstismar yokEPSS %0

    vikunja · vikunja24 Mar 2026

  • CVE-2026-33680
    26İzleyin

    Vikunja Vulnerable to Link Share Hash Disclosure via ReadAll Endpoint Enables Permission Escalation

    OrtaCVSS 6,5İstismar yokEPSS %0

    vikunja · vikunja24 Mar 2026

  • CVE-2026-35594
    26İzleyin

    Vikunja Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgrade

    OrtaCVSS 6,5İstismar yokEPSS %0

    vikunja · vikunja10 Nis 2026

  • CVE-2026-33676
    26İzleyin

    Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read

    OrtaCVSS 6,5İstismar yokEPSS %0

    vikunja · vikunja24 Mar 2026

  • CVE-2026-33677
    26İzleyin

    Webhook BasicAuth Credentials Exposed to Read-Only Project Collaborators via API

    OrtaCVSS 6,5İstismar yokEPSS %0

    vikunja · vikunja24 Mar 2026

  • CVE-2026-33335
    25İzleyin

    Vikunja Desktop allows arbitrary local application invocation via unvalidated shell.openExternal

    OrtaCVSS 6,4İstismar yokEPSS %0

    vikunja · vikunja24 Mar 2026

  • CVE-2026-27116
    24İzleyin

    Vikunja has Reflected HTML Injection via filter Parameter in Projects Module

    OrtaCVSS 6,1İstismar yokEPSS %0

    vikunja · vikunja25 Şub 2026