CVE records Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program , by email as they are published. Where the data comes from: sources .
Updated under an hour ago (2026-10-19 11:23 UTC )
This week: 5,500 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.
Published in the last 7 days 5,500 Show in the list Critical, last 7 days 358 Show in the list Healthcare-tagged, last 7 days 5 Show in the list Known exploited (CISA KEV) 1,747 Show in the list Showing CVEs that name the product go_vikunja:vikunja . Show all products
30 CVEs, showing 1 to 30
CVE Severity Title Published CVE-2026-111922 Medium 6.3 Vikunja 2.2.0 before 2.7.0 Permissive CORS Policy Trusting Localhost Origins Assigned by VulnCheck
Oct 17, 2026 CVE-2026-111921 Medium 5.4 Vikunja 0.13.0 before 2.7.0 Incorrect Authorization in Link Share Deletion Assigned by VulnCheck
Oct 17, 2026 CVE-2026-111920 Medium 4.3 Vikunja 2.6.0 Broken Access Control via Inherited Project Permissions Assigned by VulnCheck
Oct 17, 2026 CVE-2026-111919 Medium 6.5 Vikunja 0.22.0 before 2.7.0 Improper Access Revocation via Webhooks Assigned by VulnCheck
Oct 17, 2026 CVE-2026-111918 Medium 5.4 Vikunja 1.0.0-rc0 before 2.7.0 Cross-Tenant Task Position Writes via Saved Filter Creation Assigned by VulnCheck
Oct 17, 2026 CVE-2026-111917 Medium 6.5 Vikunja 2.3.0 before 2.7.0 WebSocket Authentication Ignores Session Revocation Assigned by VulnCheck
Oct 17, 2026 CVE-2026-62376 High 8.1 Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access Assigned by GitHub_M
Oct 9, 2026 CVE-2026-62367 High 7.5 Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover Assigned by GitHub_M
Oct 9, 2026 CVE-2026-57458 High 8.1 Vikunja: Scoped API token can mint unrestricted OAuth session credentials Assigned by GitHub_M
Oct 9, 2026 CVE-2026-91985 High 7.5 Vikunja before 2.6.0 Privilege Escalation via Link Share Hash Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91984 Medium 4.3 Vikunja before 2.6.0 Broken Object-Level Authorization via task-position Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91983 Medium 4.3 Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91982 Medium 4.3 Vikunja before 2.6.0 TOTP Secret Disclosure via API Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91981 Medium 4.3 Vikunja before 2.6.0 User Enumeration via v2 API Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91980 Medium 4.3 vikunja before 2.6.0 Team Enumeration via Project Share Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91979 Medium 6.5 Vikunja before 2.6.0 Denial of Service via Decompression Bomb Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91973 High 7.5 Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91972 High 7.5 Vikunja before 2.6.0 Authentication Bypass via Unthrottled API Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91971 Medium 6.5 Vikunja before 2.6.0 Denial of Service via Avatar Upload Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91970 Medium 6.5 Vikunja before 2.6.0 Resource Exhaustion via Planka Migration Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91969 Medium 6.5 vikunja before 2.6.0 Resource Exhaustion via CSV Migration Assigned by VulnCheck
Sep 15, 2026 CVE-2026-91968 Medium 6.5 vikunja before 2.6.0 Denial of Service via unbounded filter recursion Assigned by VulnCheck
Sep 15, 2026 CVE-2026-55067 Medium 5.0 Vikunja: Authenticated cross-tenant kanban-bucket relocation via `project_view_id` mass-assignment Assigned by GitHub_M
Aug 28, 2026 CVE-2026-55066 High 7.1 Vikunja: Cross-tenant IDOR in kanban move-task endpoint via unauthorized body task_id Assigned by GitHub_M
Aug 28, 2026 CVE-2026-55065 High 8.1 Vikunja: Improper Authorization and Authorization Bypass Through User-Controlled Key in code.vikunja.io/api Assigned by GitHub_M
Aug 28, 2026 CVE-2026-55064 Medium 4.3 Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 Assigned by GitHub_M
Aug 28, 2026 CVE-2026-54766 Medium 5.3 Vikunja: Project duplication bypasses write-permission check on the target parent project Assigned by GitHub_M
Aug 28, 2026 CVE-2026-76216 High 7.5 Vikunja through 2.4.0 Principal-Type Confusion via LinkSharing Assigned by VulnCheck
Aug 19, 2026 CVE-2026-68582 Medium 6.5 Vikunja 0.24.0 Broken Object Level Authorization via Link-Share Token Assigned by VulnCheck
Aug 2, 2026 CVE-2026-68581 High 8.1 Vikunja 0.22.0 through 2.3.0 Authentication Bypass via Principal ID Collision Assigned by VulnCheck
Aug 2, 2026
CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.
© 2026 MTC Group, LLC. All rights reserved. InfoSec Signals™ and the InfoSec Signals logo are trademarks of MTC Group, LLC.
Printed from infosec-signals.mtcgroupllc.com. Every record links back to the agency that published it.
