Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
60 results · page 2 of 2
Dec 15, 2025An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16.CVE-2025-65782 · Other software · Wekan Project · reported by MITREMedium 6.5
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authorization flaw in card update handling allows board members (and potentially other authenticated users) to add/remove arbitrary user IDs in vote.positive / vote.negative arrays, enabling vote forgery and unauthorized voting.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16.CVE-2025-65781 · Other software · Wekan Project · reported by MITREHigh 8.2
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Attachment upload API treats the Authorization bearer value as a userId and enters a non-terminating body-handling branch for any non-empty bearer token, enabling trivial application-layer DoS and latent identity-spoofing.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16.CVE-2025-65780 · Other software · Wekan Project · reported by MITREHigh 8.8
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Authenticated users can update their entire user document (beyond profile fields), including orgs/teams and loginDisabled, due to missing server-side authorization checks; this enables privilege escalation and unauthorized access to other teams/orgs.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16.CVE-2025-65779 · Other software · Wekan Project · reported by MITREHigh 7.5
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Unauthenticated attackers can update a board's "sort" value (Boards.allow returns true without verifying userId), allowing arbitrary reordering of boards.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 15, 2025An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16.CVE-2025-65778 · Other software · Wekan Project · reported by MITREHigh 8.1
An issue was discovered in Wekan The Open Source kanban board system up to version 18.15, fixed in 18.16. Uploaded attachments can be served with attacker-controlled Content-Type (text/html), allowing execution of attacker-supplied HTML/JS in the application's origin and enabling session/token theft and CSRF actions.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2023A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script oCVE-2023-28485 · Other software · Wekan Project · reported by MITREMedium 5.4
A stored cross-site scripting (Stored XSS) vulnerability in file preview in WeKan before 6.75 allows remote authenticated users to inject arbitrary web script or HTML via names of file attachments. Any user can obtain the privilege to rename within their own board (where they have BoardAdmin access), and renameAttachment does not block XSS payloads.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comwekan.github.io
May 22, 2023Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS).CVE-2023-31779 · Other software · Wekan Project · reported by MITREMedium 5.4
Wekan v6.84 and earlier is vulnerable to Cross Site Scripting (XSS). An attacker with user privilege on kanban board can insert JavaScript code in in "Reaction to comment" feature.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 10, 2021Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scripting.CVE-2021-20654 · Other software · Wekan Team · reported by vultures@jpcert.or.jpMedium 5.4
Wekan, open source kanban board system, between version 3.12 and 4.11, is vulnerable to multiple stored cross-site scripting. This is named 'Fieldbleed' in the vendor's site.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 26, 2021packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,CVE-2021-3309 · Other software · Wekan Project · reported by MITREHigh 8.1
packages/wekan-ldap/server/ldap.js in Wekan before 4.87 can process connections even though they are not authorized by the Certification Authority trust store,
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 26, 2018Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker cCVE-2018-1000549 · Other software · Wekan Project · reported by MITREMedium 5.3
Wekan version 1.04.0 contains a Email / Username Enumeration vulnerability in Register' and 'Forgot your password?' pages that can result in A remote attacker could perform a brute force attack to obtain valid usernames and email addresses.. This attack appear to be exploitable via HTTP Request.
- Product
- Wekan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordraw.githubusercontent.comshadow-vault.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.