Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 4,822

CVE-2026-123500

Vikunja before 2.7.1 Insecure Permissions on Dump Archive via vikunja dump

Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives created with umask permissions by the vikunja dump command. Local attackers on a shared host can read the world-readable zip in the rootpath to obtain config, password hashes, TOTP secrets, tokens, and stored files.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja
CVE-2026-123496

Vikunja veans before 2.7.1 Symlink Following in veans init

Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write files outside the repository via crafted repo symlinks. Attackers can ship symlinked .veans.yml, .claude, or .opencode entries to overwrite user files like ~/.bashrc or install veans hooks and plugins globally.

CVSS 4.0 · 4.8 Medium EPSS < 1% KEV · Not listed
Vendors
Vikunja
Products
Vikunja