GO-2026-4480
NoneCVSS
—
EPSS
—
Published
Feb 17, 2026
CISA due date
—
The record
Vikunja Vulnerable to XSS Via Task Preview in code.vikunja.io/api
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | code.vikunja.io/api | 0 | No fix |
Related vulnerabilities
- CVE-2026-25935 Vikunja is a todo-app to organize your life. Same vulnerability
- GHSA-rfjg-6m84-crj2 Vikunja Vulnerable to Account Takeover via Password Reset Token Reuse Also affects code.vikunja.io/api
- CVE-2026-28268 Vikunja is an open-source self-hosted task management platform. Also affects code.vikunja.io/api
- GHSA-42wg-38gx-85rh Vikunja has Path Traversal in CLI Restore Also affects code.vikunja.io/api
- GHSA-7jp5-298q-jg98 Vikunja: Stored XSS via Unsanitized SVG Attachment Upload Leads to Token Exposure Also affects code.vikunja.io/api
- CVE-2026-27819 Vikunja is an open-source self-hosted task management platform. Also affects code.vikunja.io/api
- CVE-2026-27575 Vikunja is an open-source self-hosted task management platform. Also affects code.vikunja.io/api
- CVE-2026-27616 Vikunja is an open-source self-hosted task management platform. Also affects code.vikunja.io/api