G
Vendor security profile
go-vikunja
Product portfolio, patch evidence and exploitation signals in a single security scorecard
The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.
Total CVEs24
Critical1
CISA KEV0
Public exploit16
Patch rate%4
Avg. CVSS6.7
12-month vulnerability rate
0
0
0
0
0
0
0
0
0
8
13
3
CVE KEV
CVE severity distribution
24toplam CVE
Critical1 (4%)
High11 (46%)
Medium12 (50%)
Patch and exploitation view
%4
Verified patch
%0
CISA KEV
%67
Public exploit
1Patch available
0Partial
0Workaround
0Vendor: no patch
23Unknown
Latest vulnerabilities
8.1
CVE-2026-62376
Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
G
Patch status unknownEPSS %0
7.5
CVE-2026-62367
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
G
Patch status unknownEPSS %0
8.1
CVE-2026-57458
Vikunja: Scoped API token can mint unrestricted OAuth session credentials
G
Patch status unknownEPSS %0
8.7
CVE-2026-91985
Vikunja before 2.6.0 Privilege Escalation via Link Share Hash
G
Patch status unknownEPSS %0
5.3
CVE-2026-91984
Vikunja before 2.6.0 Broken Object-Level Authorization via task-position
G
Patch status unknownEPSS %0
5.3
CVE-2026-91983
Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter
G
Patch status unknownEPSS %0
4.3
CVE-2026-91982
Vikunja before 2.6.0 TOTP Secret Disclosure via API
G
Patch status unknownEPSS %0
4.3
CVE-2026-91981
Vikunja before 2.6.0 User Enumeration via v2 API
G
Patch status unknownEPSS %0
4.3
CVE-2026-91980
vikunja before 2.6.0 Team Enumeration via Project Share
G
Patch status unknownEPSS %0
6.5
CVE-2026-91979
Vikunja before 2.6.0 Denial of Service via Decompression Bomb
G
Patch status unknownEPSS %0