CVE-2026-115507

Vikunja versions 2.2.0 before 2.7.1 are vulnerable to an HTML injection flaw within the CreateConversationalHeader function in pkg/notifications/mail.go. The vulnerability occurs because the application interpolates display names, task titles, and project titles raw into email anchors. An authent...

EUVD-2026-108339

Vikunja 2.2.0 before 2.7.1 contains an HTML injection vulnerability in CreateConversationalHeader in pkg/notifications/mail.go that interpolates display names and task and project titles raw into email anchors. Authenticated users can craft titles or display names that close the anchor and inject...