Vikunja
Security Risk Profile
Security Risk Score
Comprehensive risk assessment based on 49 vulnerabilities, EPSS scores, exploitation status, and remediation availability.
📅 Data spans from February 11, 2026 to present
Threat Assessment
Severity Distribution
Exploit Likelihood
Age Distribution
Common Weaknesses (CWE)
Most Affected Products
Recent Vulnerabilities
See more →Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access
Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover
Vikunja before 2.6.0 Privilege Escalation via Link Share Hash
Vikunja before 2.6.0 Broken Object-Level Authorization via task-position
Vikunja before 2.6.0 API Token Scope Bypass via expand Parameter
Vikunja before 2.6.0 User Enumeration via v2 API
Vikunja before 2.6.0 Authentication Bypass via CalDAV BasicAuth
Vikunja before 2.6.0 Authentication Bypass via Unthrottled API
Vikunja before 2.6.0 Denial of Service via Avatar Upload
Vikunja before 2.6.0 Resource Exhaustion via Planka Migration
Monitor Vikunja in Real-Time
Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.