666 matches found
CVE-2023-31779
CVE-2023-31779 Stored XSS in Wekan Description : Stored XSS vulnerability exists in the "Reaction to comment" feature. An attacker with user privilege on kanban board can execute JavaScript code in the browsers of users who open card with malicious reaction. Impact : An attacker can steal...
CVE-2026-123519
Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a 22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the weka...
CVE-2026-123519
Vikunja versions prior to 2.7.1 are vulnerable to a Memory Exhaustion Denial of Service (DoS) . The issue resides in the wekan migrate endpoint, which lacks an item-count cap when processing WeKan or vikunja-file imports. An authenticated attacker can crash the instance by submitting a large WeKa...
CVE-2026-123519 Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports
Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a 22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the weka...
EUVD-2026-119404
Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a 22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the weka...
CVE-2026-123519 Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports
Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a 22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the weka...
CVE-2026-123519: go-vikunja vikunja: Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process…
Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a 22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the weka...
PT-2026-139800
Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a 22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the weka...
CVE-2026-119300
Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp without escaping regular-expression...
CVE-2026-119300 Wekan: ReDoS via Unescaped User Input in RegExp
Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp without escaping regular-expression...
CVE-2026-119300 Wekan: ReDoS via Unescaped User Input in RegExp
Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp without escaping regular-expression...
EUVD-2026-114193
Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp without escaping regular-expression...
CVE-2026-119300
The open-source kanban application Wekan is vulnerable to a Regular Expression Denial of Service (ReDoS) in versions prior to 11.11 . The root cause is the lack of escaping for regular-expression metacharacters when authenticated users provide searchTerm and query values to the user-search public...
CVE-2026-119300: wekan: Wekan is open source kanban built with Meteor
Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp without escaping regular-expression...
PT-2026-133683
Wekan is open source kanban built with Meteor. Prior to 11.11, the user-search publication in server/publications/users.js and the searchUsers method in server/models/users.js pass authenticated user-controlled searchTerm and query values to new RegExp without escaping regular-expression...
CVE-2026-103256
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...
CVE-2026-103256
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...
CVE-2026-103256 n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...
CVE-2026-103256 n8n before 2.39.6 and 2.40.x before 2.40.1 Credentials Leak via preAuthentication Hook
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...
EUVD-2026-90650
n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...