CVE-2026-123516

Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the...

CVE-2026-123519

Vikunja versions prior to 2.7.1 are vulnerable to a Memory Exhaustion Denial of Service (DoS) . The issue resides in the wekan migrate endpoint, which lacks an item-count cap when processing WeKan or vikunja-file imports. An authenticated attacker can crash the instance by submitting a large WeKa...

CVE-2026-123519 Vikunja before 2.7.1 Memory Exhaustion DoS via WeKan and Vikunja-File Imports

Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a 22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the weka...

CVE-2026-123516 Vikunja before 2.7.1 Resource Exhaustion via Vikunja-File ZIP Import

Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the...

EUVD-2026-119401

Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the...

CVE-2026-123516

Vikunja versions before 2.7.1 are susceptible to a resource exhaustion vulnerability in the vikunja-file ZIP importer . An authenticated user can consume significant CPU and memory by uploading ZIP archives containing excessive entries, such as many empty or non-file entries. These specific entri...

CVE-2026-123516: go-vikunja vikunja: Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows…

Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the...

PT-2026-139800

Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process memory by uploading WeKan or vikunja-file imports with no item-count cap. Attackers can submit a 22 MB WeKan JSON with hundreds of thousands of cards or duplicate IDs to the weka...

PT-2026-139797

Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows authenticated users to consume CPU and memory by uploading archives with excessive entries. Attackers can upload export ZIPs containing many empty or non-files/ entries that bypass the...