code.vikunja.io/api vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-76216Highcode.vikunja.io/api: Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosureCVE-2026-68582Criticalcode.vikunja.io/api: Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)CVE-2026-68581Highcode.vikunja.io/api: Vikunja: Link-share principal ID collision allows cross-account API token issuance and managementCVE-2026-57458Highcode.vikunja.io/api: Vikunja: Scoped API token can mint unrestricted OAuth session credentialsCVE-2026-55067Mediumcode.vikunja.io/api: Vikunja vulnerable to authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignmentCVE-2026-55066Highcode.vikunja.io/api: Vikunja has cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_idCVE-2026-55065Highcode.vikunja.io/api: Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled KeyCVE-2026-55064Mediumcode.vikunja.io/api: Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0CVE-2026-54766Mediumcode.vikunja.io/api: Vikunja has a project duplication bypasses write-permission check on the target parent projectCVE-2026-40103Mediumcode.vikunja.io/api: Vikunja: Scoped API tokens with projects.background permission can delete project backgroundsCVE-2026-35602Mediumcode.vikunja.io/api: Vikunja has File Size Limit Bypass via Vikunja ImportCVE-2026-35601Mediumcode.vikunja.io/api: Vikunja has iCalendar Property Injection via CRLF in CalDAV Task OutputCVE-2026-35600Mediumcode.vikunja.io/api: Vikunja has HTML Injection via Task Titles in Overdue Email NotificationsCVE-2026-35599Mediumcode.vikunja.io/api: Vikunja has Algorithmic Complexity DoS in Repeating Task HandlerCVE-2026-35598Mediumcode.vikunja.io/api: Vikunja Missing Authorization on CalDAV Task ReadCVE-2026-35597Mediumcode.vikunja.io/api: Vikunja Vulnerable to TOTP Brute-Force Due to Non-Functional Account LockoutCVE-2026-35596Mediumcode.vikunja.io/api: Vikunja has Broken Access Control on Label Read via SQL Operator Precedence BugCVE-2026-35595Highcode.vikunja.io/api: Vikunja vulnerable to Privilege Escalation via Project ReparentingCVE-2026-35594Mediumcode.vikunja.io/api: Vikunja: Link Share JWT tokens remain valid for 72 hours after share deletion or permission downgradeCVE-2026-34727Highcode.vikunja.io/api: Vikunja has TOTP Two-Factor Authentication Bypass via OIDC Login PathGHSA-2PV8-4C52-MF8JCriticalcode.vikunja.io/api: Vikunja: Unauthenticated Instance-Wide Data Breach via Link Share Hash Disclosure Chained with Cross-Project Attachment IDORCVE-2026-33700Mediumcode.vikunja.io/api: Vikunja has a Link Share Delete IDOR — Missing Project Ownership Check Allows Cross-Project Link Share DeletionCVE-2026-33680Highcode.vikunja.io/api: Vikjuna: Link Share Hash Disclosure via ReadAll Endpoint Enables Permission EscalationCVE-2026-33679Mediumcode.vikunja.io/api: Vikjuna Bypasses Webhook SSRF Protections During OpenID Connect Avatar Download CVE-2026-33678Highcode.vikunja.io/api: Vikjuna: IDOR in Task Attachment ReadOne Allows Cross-Project File Access and Deletion

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo