CVE-2026-30847 | Medium | 6.5 | 2026-03-06 | Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the notificationUsers publication in Wekan publishes user documents wit… |
CVE-2026-30846 | High | 7.5 | 2026-03-06 | Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the globalwebhooks publication exposes all global webhook integrations—… |
CVE-2026-30845 | High | 8.2 | 2026-03-06 | Wekan is an open source kanban tool built with Meteor. In versions 8.31.0 through 8.33, the board composite publication in Wekan publishes all integration data… |
CVE-2026-30844 | High | 8.1 | 2026-03-06 | Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 are vulnerable to Server-Side Request Forgery (SSRF) via attachment URL loading… |
CVE-2026-30843 | Medium | 6.5 | 2026-03-06 | Wekan is an open source kanban tool built with Meteor. Versions 8.32 and 8.33 have a critical Insecure Direct Object Reference (IDOR) issue which could allow u… |
CVE-2026-2209 | Medium | 6.3 | 2026-02-08 | A vulnerability was detected in WeKan up to 8.18. The affected element is the function setCreateTranslation of the file client/components/settings/translationB… |
CVE-2026-2208 | Medium | 4.3 | 2026-02-08 | A security vulnerability has been detected in WeKan up to 8.20. Impacted is an unknown function of the file server/publications/rules.js of the component Rules… |
CVE-2026-2207 | Medium | 5.3 | 2026-02-08 | A weakness has been identified in WeKan up to 8.20. This issue affects some unknown processing of the file server/publications/activities.js of the component A… |
CVE-2026-2206 | Medium | 6.3 | 2026-02-08 | A security flaw has been discovered in WeKan up to 8.20. This vulnerability affects unknown code of the file server/methods/fixDuplicateLists.js of the compone… |
CVE-2026-2205 | Medium | 4.3 | 2026-02-08 | A vulnerability was identified in WeKan up to 8.20. This affects an unknown part of the file server/publications/cards.js of the component Meteor Publication H… |
CVE-2026-25859 | High | 8.8 | 2026-02-07 | Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in u… |
CVE-2026-25568 | Medium | 4.3 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforce… |
CVE-2026-25567 | Medium | 4.3 | 2026-02-07 | WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in the card comment creation API. The endpoint accepts an authorId from the req… |
CVE-2026-25566 | Medium | 5.4 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic. A user can specify a destination board/list/swimlane without adequate a… |
CVE-2026-25565 | Medium | 6.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring w… |
CVE-2026-25564 | High | 7.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not… |
CVE-2026-25563 | High | 7.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes. The implementation does not… |
CVE-2026-25562 | Medium | 4.3 | 2026-02-07 | WeKan versions prior to 8.19 contain an information disclosure vulnerability in the attachments publication. Attachment metadata can be returned without proper… |
CVE-2026-25561 | High | 7.5 | 2026-02-07 | WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API. The API does not fully validate that provided identifiers (such as… |
CVE-2026-25560 | Critical | 9.8 | 2026-02-07 | WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication. User-supplied username input is incorporated into LDAP sear… |
CVE-2026-1964 | Medium | 4.3 | 2026-02-05 | A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endpoint. This manipula… |
CVE-2026-1963 | Medium | 6.3 | 2026-02-05 | A vulnerability was found in WeKan up to 8.20. This affects an unknown function of the file models/attachments.js of the component Attachment Storage. The mani… |
CVE-2026-1962 | Medium | 6.3 | 2026-02-05 | A vulnerability has been found in WeKan up to 8.20. The impacted element is an unknown function of the file server/attachmentMigration.js of the component Atta… |
CVE-2026-1898 | Medium | 6.3 | 2026-02-05 | A vulnerability was determined in WeKan up to 8.20. This affects an unknown part of the file packages/wekan-ldap/server/syncUser.js of the component LDAP User… |
CVE-2026-1897 | Medium | 4.3 | 2026-02-05 | A vulnerability was found in WeKan up to 8.20. Affected by this issue is some unknown functionality of the file server/methods/positionHistory.js of the compon… |
CVE-2026-1896 | Medium | 6.3 | 2026-02-05 | A vulnerability has been found in WeKan up to 8.20. Affected by this vulnerability is the function ComprehensiveBoardMigration of the file server/migrations/co… |
CVE-2026-1895 | Medium | 6.3 | 2026-02-04 | A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Exec… |
CVE-2026-1894 | Medium | 6.3 | 2026-02-04 | A vulnerability was detected in WeKan up to 8.20. This impacts an unknown function of the file models/checklistItems.js of the component REST API. Performing a… |
CVE-2026-1892 | Medium | 5.0 | 2026-02-04 | A security vulnerability has been detected in WeKan up to 8.20. This affects the function setBoardOrgs of the file models/boards.js of the component REST API… |
CVE-2025-65782 | Medium | 6.5 | 2025-12-15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows boa… |
CVE-2025-65781 | High | 8.2 | 2025-12-15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer… |
CVE-2025-65780 | High | 8.8 | 2025-12-15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user docu… |
CVE-2025-65779 | High | 7.5 | 2025-12-15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort"… |
CVE-2025-65778 | High | 8.1 | 2025-12-15 | An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-cont… |
CVE-2023-28485 | Medium | 5.4 | 2023-06-26 | A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script… |
CVE-2023-31779 | Medium | 5.4 | 2023-05-22 | Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). An attacker with user privilege on kanban board can insert JavaScript code in in "Reaction… |
CVE-2021-20654 | Medium | 5.4 | 2021-02-10 | Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scripting. This is named 'Fieldbleed' in the… |
CVE-2021-3309 | High | 8.1 | 2021-01-26 | packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store, |
CVE-2018-1000549 | Medium | 5.3 | 2018-06-26 | Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker… |