PkgSeer

Vulnerabilities

Last updated 2 hours ago
Filters
Severity
Critical Severity
CVSS Score Range: 9.0–10.0
Critical severity vulnerabilities (CVSS 9.0–10.0). These represent the highest impact issues.
High Severity
CVSS Score Range: 7.0–8.9
High severity vulnerabilities (CVSS 7.0–8.9). Serious vulnerabilities that should be prioritized soon after critical fixes.
Medium Severity
CVSS Score Range: 4.0–6.9
Medium severity vulnerabilities (CVSS 4.0–6.9). Important issues that meaningfully reduce security confidence.
Low Severity
CVSS Score Range: < 4.0
Low severity vulnerabilities (CVSS < 4.0). Hygiene issues that can accumulate but pose lower immediate risk.
Unknown Severity
CVSS Score Range: No score
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
Package Summary Severity Published Modified
code.vikunja.io/api Vikunja: Cross-project task disclosure through subtask expansion Medium Risk 6.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Assignee email addresses disclosed to read-only project members via the task assignees endpoint Medium Risk 6.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID Medium Risk 6.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal Low Risk 3.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited High Risk 8.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) Medium Risk 6.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check Medium Risk 6.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification High Risk 8.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Unbounded CSV row cardinality permits API process termination High Risk 8.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) Critical 9.5 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: TOTP secret is readable after enrollment, no step-up auth Medium Risk 6.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Link-share principal ID collision allows cross-account API token issuance and management High Risk 8.1 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project Medium Risk 6.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure High Risk 7.5 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Planka migration retains an unbounded aggregate of attacker-served attachments and can OOM the API High Risk 8.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2) Medium Risk 6.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Unbounded nested task-filter recursion permits API process termination High Risk 8.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes Medium Risk 6.5 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) Medium Risk 5.4 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted High Risk 8.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level High Risk 8.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Link-share token can enumerate users through the v2 API Medium Risk 6.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover High Risk 8.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Denial of service via decompression bomb in the data import High Risk 8.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: CalDAV and feeds BasicAuth endpoints have no rate limit, bypassing the anti-brute-force floor on account passwords Medium Risk 6.0 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access High Risk 8.1 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Scoped API token can mint unrestricted OAuth session credentials High Risk 8.1 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants Medium Risk 5.4 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed Medium Risk 6.5 10 days ago 5 hours ago
code.vikunja.io/api Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Unbounded image decode on avatar and project-background uploads enables decode/resize amplification in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Every /api/v2 pre-auth endpoint is unthrottled on a stock install while its /api/v1 twin is rate limited in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: TOTP secret is readable after enrollment, no step-up auth in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts) in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Link-share token can enumerate users through the v2 API in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Link-share principal ID collision allows cross-account API token issuance and management in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Plaintext storage of password-reset/email-confirm tokens in database enables account takeover on DB read access in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Scoped API token can mint unrestricted OAuth session credentials in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Cross-project task disclosure through subtask expansion in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA) in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: OIDC email-fallback account linking ignores email_verified, enabling local-account takeover in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2) in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
code.vikunja.io/api Vikunja: Unbounded nested task-filter recursion permits API process termination in code.vikunja.io/api Unknown 5 hours ago 5 hours ago
Data courtesy of OSV.dev
Page 1