code.vikunja.io/api vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
GHSA-M687-P538-R5HPHighcode.vikunja.io/api: Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trustedGHSA-FMMF-XQ98-G327Mediumcode.vikunja.io/api: Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission checkGHSA-PJR3-86V4-5P7WMediumcode.vikunja.io/api: Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control /…GHSA-HJX8-QV73-F7CMMediumcode.vikunja.io/api: Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feedGHSA-FPRF-R6RV-XG99Mediumcode.vikunja.io/api: Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenantsGHSA-4HV6-XC92-J86GMediumcode.vikunja.io/api: Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushesGHSA-W2CH-4XGR-22WWLowcode.vikunja.io/api: Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removalGHSA-8WVG-R2J4-3737Mediumcode.vikunja.io/api: Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpointGHSA-3HC7-R24J-RPWCMediumcode.vikunja.io/api: Vikunja: Cross-project task disclosure through subtask expansionGHSA-G38J-7V97-X298Mediumcode.vikunja.io/api: Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UIDCVE-2026-91970Highcode.vikunja.io/api: Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the APICVE-2026-91969Highcode.vikunja.io/api: Vikunja: Unbounded CSV row cardinality permits API process terminationCVE-2026-91968Highcode.vikunja.io/api: Vikunja: Unbounded nested task-filter recursion permits API process terminationCVE-2026-91979Highcode.vikunja.io/api: Vikunja: Denial of service via decompression bomb in the data importCVE-2026-91981Mediumcode.vikunja.io/api: Vikunja: Link-share token can enumerate users through the v2 APICVE-2026-91980Mediumcode.vikunja.io/api: Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway projectCVE-2026-91971Highcode.vikunja.io/api: Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplificationCVE-2026-91973Mediumcode.vikunja.io/api: Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwordsCVE-2026-91983Mediumcode.vikunja.io/api: Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)CVE-2026-91984Mediumcode.vikunja.io/api: Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task…CVE-2026-91985Highcode.vikunja.io/api: Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to…CVE-2026-91982Mediumcode.vikunja.io/api: Vikunja: TOTP secret is readable after enrollment, no step-up authCVE-2026-91972Highcode.vikunja.io/api: Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limitedCVE-2026-62376Highcode.vikunja.io/api: Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read accessCVE-2026-62367Highcode.vikunja.io/api: Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo