CVE-2026-55652 | Critical | 9.8 | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADER_LOGIN_TRUSTED_IPS uses getRequestIp() in server/lib/headerLoginAuth.js t… |
CVE-2026-55234 | High | 8.5 | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.37, Wekan DDP update allow rules in server/permissions/cards.js, server/permissions/lists.js, and ser… |
CVE-2026-53447 | Medium | 6.5 | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to buil… |
CVE-2026-53446 | | | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan webhook integration URLs in models/integrations.js are stored from user input and later fet… |
CVE-2026-53445 | | | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publications/boards.js copies a board by caller-s… |
CVE-2026-53444 | | | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/oidc_server.js, server/models/org.js, an… |
CVE-2026-52893 | | | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan Accounts.onCreateUser hook in server/models/users.js merges OIDC logins into existing a… |
CVE-2026-52892 | Medium | 6.5 | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAcce… |
CVE-2026-52891 | Critical | 9.9 | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.07, Wekan avatar upload functionality embeds user-supplied filenames into paths later passed to child… |
CVE-2026-52890 | High | 7.1 | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.31, Wekan allows a logged-in board member to insert an attachment document through the /attachments/i… |
CVE-2026-59154 | Medium | 4.3 | 2026-07-10 | Wekan is open source kanban built with Meteor. Prior to 9.64, Wekan has a cross-board authorization bypass in the direct Meteor collection allow rules for Chec… |
CVE-2026-41455 | High | 8.5 | 2026-04-22 | WeKan before 8.35 contains a server-side request forgery vulnerability in webhook integration URL handling where the URL scheme field accepts any string withou… |
CVE-2026-41454 | High | 8.3 | 2026-04-22 | WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform admin… |
CVE-2026-30847 | Medium | 6.5 | 2026-03-06 | Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the notificationUsers publication in Wekan publishes user documents wit… |
CVE-2026-30846 | High | 7.5 | 2026-03-06 | Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the globalwebhooks publication exposes all global webhook integrations—… |
CVE-2026-30845 | High | 8.2 | 2026-03-06 | Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the board composite publication in Wekan publishes all integration data… |
CVE-2026-30844 | High | 8.1 | 2026-03-06 | Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 are vulnerable to Server-Side Request Forgery (SSRF) via attachment URL loading… |
CVE-2026-30843 | Medium | 6.5 | 2026-03-06 | Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 have a critical Insecure Direct Object Reference (IDOR) issue which could allow u… |
CVE-2026-25859 | High | 8.8 | 2026-02-07 | Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in u… |
CVE-2026-25568 | Medium | 4.3 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforce… |
CVE-2026-25567 | Medium | 4.3 | 2026-02-07 | WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an authorId from the req… |
CVE-2026-25566 | Medium | 5.4 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic. A user can specify a destination board/list/swimlane without adequate a… |
CVE-2026-25565 | Medium | 6.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring w… |
CVE-2026-25564 | High | 7.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not… |
CVE-2026-25563 | High | 7.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not… |
CVE-2026-25562 | Medium | 4.3 | 2026-02-07 | WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication. Attachment metadata can be returned without proper… |
CVE-2026-25561 | High | 7.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided identifiers (such as… |
CVE-2026-25560 | Critical | 9.8 | 2026-02-07 | WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP sear… |