wekan vulnerabilities

36 published CVEs name wekan among the affected products.

Newest CVEs

CVE-2026-119300
Wekan: ReDoS via Unescaped User Input in RegExp
wekan · wekan
Medium6.5
CVE-2026-68901
WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Service
wekan · wekan
Medium6.5
CVE-2026-68900
Wekan: Stored XSS in HTML board exports through a card-title second parse
wekan · wekan
High7.6
CVE-2026-68899
Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallback
wekan · wekan
High8.7
CVE-2026-68561
Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rule
wekan · wekan
High8.8
CVE-2026-68560
Wekan:hell Injection in External Antivirus Scanner Path via asyncExec
wekan · wekan
High7.7
CVE-2026-68558
Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)
wekan · wekan
High8.5
CVE-2026-68559
Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)
wekan · wekan
Medium6.5
CVE-2026-55652
Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)
wekan · wekan
Critical9.8
CVE-2026-55234
Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)
wekan · wekan
High8.5