The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123519: go-vikunja vikunja: Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-123518: go-vikunja vikunja: Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write…4.3 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123517: go-vikunja vikunja: Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine…4.3 Medium7.1 HighN/ANov 8, 2026
CVE-2026-123516: go-vikunja vikunja: Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows…4.3 Medium7.1 HighN/ANov 8, 2026
CVE-2026-123515: go-vikunja vikunja: Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make…4.1 Medium5.1 MediumN/ANov 8, 2026
CVE-2026-123514: go-vikunja vikunja: Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned…4.3 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123513: go-vikunja vikunja: Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by…6.8 Medium7.6 HighN/ANov 8, 2026
CVE-2026-123512: go-vikunja vikunja: Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string…6.1 Medium8.4 HighN/ANov 8, 2026
CVE-2026-123511: go-vikunja vikunja: Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated CalDAV…4.3 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123510: go-vikunja vikunja: Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and…3.3 Low1.0 LowN/ANov 8, 2026
CVE-2026-123509: go-vikunja vikunja: Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows project writers or view…4.3 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123508: go-vikunja vikunja: Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and…3.1 Low2.0 LowN/ANov 8, 2026
CVE-2026-123507: go-vikunja vikunja: Vikunja from 0.24.0 before 2.7.1 contains a nil pointer dereference vulnerability that allows project admins to break…2.7 Low5.1 MediumN/ANov 8, 2026
CVE-2026-123506: go-vikunja vikunja: Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped…5.4 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123505: go-vikunja vikunja: Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data…5.5 Medium6.8 MediumN/ANov 8, 2026
CVE-2026-123504: go-vikunja vikunja: Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members…4.3 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123503: go-vikunja vikunja: Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project…5.4 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123502: go-vikunja vikunja: Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes…5.2 Medium6.9 MediumN/ANov 8, 2026
CVE-2026-123501: go-vikunja vikunja: Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-123500: go-vikunja vikunja: Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives…6.2 Medium6.9 MediumN/ANov 8, 2026
CVE-2026-123499: go-vikunja vikunja: Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to…5.9 Medium6.0 MediumN/ANov 8, 2026
CVE-2026-123498: go-vikunja vikunja: Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to…3.7 Low2.1 LowN/ANov 8, 2026
CVE-2026-123497: go-vikunja vikunja: Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path…6.8 Medium7.6 HighN/ANov 8, 2026
CVE-2026-123496: go-vikunja vikunja: Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write…3.3 Low4.8 MediumN/ANov 8, 2026
CVE-2026-123495: go-vikunja vikunja: Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or…4.6 Medium5.1 MediumN/ANov 8, 2026
126-150 of 522604
‹›