agentprime: wekanEvery new CVE for wekan.https://agentprime.io/CVE-2026-119300: Wekan: ReDoS via Unescaped User Input in RegExphttps://agentprime.io/advisories/CVE-2026-119300/https://agentprime.io/advisories/CVE-2026-119300/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 30 Oct 2026 16:29:16 GMTCVECVE-2026-68901: WeKan Board Export REST Endpoints: NULL Pointer Dereference on Invalid authToken Leads to Uncaught Exception / Remote Denial of Servicehttps://agentprime.io/advisories/CVE-2026-68901/https://agentprime.io/advisories/CVE-2026-68901/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 19:27:58 GMTCVECVE-2026-68900: Wekan: Stored XSS in HTML board exports through a card-title second parsehttps://agentprime.io/advisories/CVE-2026-68900/https://agentprime.io/advisories/CVE-2026-68900/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 19:26:57 GMTCVECVE-2026-68899: Wekan: File Upload MIME Type Validation Bypass — Stored XSS via Missing System Binary Fallbackhttps://agentprime.io/advisories/CVE-2026-68899/https://agentprime.io/advisories/CVE-2026-68899/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 19:26:06 GMTCVECVE-2026-68561: Wekan: a low-privilege board member escalates to board admin and takes over a private board via the `sort` collection-allow rulehttps://agentprime.io/advisories/CVE-2026-68561/https://agentprime.io/advisories/CVE-2026-68561/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 19:24:58 GMTCVECVE-2026-68560: Wekan:hell Injection in External Antivirus Scanner Path via asyncExechttps://agentprime.io/advisories/CVE-2026-68560/https://agentprime.io/advisories/CVE-2026-68560/CVSS 7.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 19:23:45 GMTCVECVE-2026-68558: Wekan: SSRF filter bypass via DNS-resolving hostname in outgoing webhooks (incomplete fix of CVE-2026-53446)https://agentprime.io/advisories/CVE-2026-68558/https://agentprime.io/advisories/CVE-2026-68558/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 19:22:18 GMTCVECVE-2026-68559: Wekan: Broken access control in the Excel-export route (`/api/boards/:boardId/exportExcel`)https://agentprime.io/advisories/CVE-2026-68559/https://agentprime.io/advisories/CVE-2026-68559/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 19 Aug 2026 19:20:32 GMTCVECVE-2026-55652: Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)https://agentprime.io/advisories/CVE-2026-55652/https://agentprime.io/advisories/CVE-2026-55652/CVSS 9.8 (Critical). Critical: CVSS score 9.8: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 21:15:11 GMTCVEcriticalCVE-2026-55234: Wekan: Broken access control: any authenticated user can move their Cards/Lists/Swimlanes into a private board they are not a member of (cross-board write via collection allow rule)https://agentprime.io/advisories/CVE-2026-55234/https://agentprime.io/advisories/CVE-2026-55234/CVSS 8.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 21:13:35 GMTCVECVE-2026-53447: Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by IDhttps://agentprime.io/advisories/CVE-2026-53447/https://agentprime.io/advisories/CVE-2026-53447/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 21:12:59 GMTCVECVE-2026-52893: Wekan: OIDC Account Takeover via Unconditional Email-Based Account Merge in onCreateUser hookhttps://agentprime.io/advisories/CVE-2026-52893/https://agentprime.io/advisories/CVE-2026-52893/CVSS 9.2 (Critical). Critical: CVSS score 9.2: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 21:12:11 GMTCVEcriticalCVE-2026-53444: Wekan: Missing authorization on OIDC Meteor methods allows privilege escalation to adminhttps://agentprime.io/advisories/CVE-2026-53444/https://agentprime.io/advisories/CVE-2026-53444/CVSS 7.6 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 21:11:38 GMTCVECVE-2026-53445: Wekan: Authorization bypass in copyBoard DDP method allows any user to copy private boardshttps://agentprime.io/advisories/CVE-2026-53445/https://agentprime.io/advisories/CVE-2026-53445/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 21:11:04 GMTCVECVE-2026-53446: Wekan: Server-Side Request Forgery (SSRF) via webhook integration URLshttps://agentprime.io/advisories/CVE-2026-53446/https://agentprime.io/advisories/CVE-2026-53446/CVSS 6.2 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 21:10:11 GMTCVECVE-2026-52892: Wekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)https://agentprime.io/advisories/CVE-2026-52892/https://agentprime.io/advisories/CVE-2026-52892/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 21:08:42 GMTCVECVE-2026-52891: Wekan: Shell Injection via Avatar Uploadhttps://agentprime.io/advisories/CVE-2026-52891/https://agentprime.io/advisories/CVE-2026-52891/CVSS 9.9 (Critical). Critical: CVSS score 9.9: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 21:08:02 GMTCVEcriticalCVE-2026-52890: Wekan: Arbitrary file read and server DoS via attachment versions.original.pathhttps://agentprime.io/advisories/CVE-2026-52890/https://agentprime.io/advisories/CVE-2026-52890/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 15 Jul 2026 21:07:16 GMTCVECVE-2026-59154: Wekan: Checklist direct DDP updates can write checklist data into private boardshttps://agentprime.io/advisories/CVE-2026-59154/https://agentprime.io/advisories/CVE-2026-59154/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 10 Jul 2026 15:45:20 GMTCVECVE-2026-41455: WeKan < 8.35 SSRF via Webhook URLhttps://agentprime.io/advisories/CVE-2026-41455/https://agentprime.io/advisories/CVE-2026-41455/CVSS 6.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Apr 2026 21:09:30 GMTCVECVE-2026-41454: WeKan < 8.35 Missing Authorization via Integration REST APIhttps://agentprime.io/advisories/CVE-2026-41454/https://agentprime.io/advisories/CVE-2026-41454/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 22 Apr 2026 21:08:38 GMTCVECVE-2026-30847: Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokenshttps://agentprime.io/advisories/CVE-2026-30847/https://agentprime.io/advisories/CVE-2026-30847/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Mar 2026 19:37:19 GMTCVEcriticalCVE-2026-30846: Wekan Exposes All Global Webhook Integrations through globalwebhooks Publicationhttps://agentprime.io/advisories/CVE-2026-30846/https://agentprime.io/advisories/CVE-2026-30846/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Mar 2026 19:35:59 GMTCVECVE-2026-30845: Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publicationhttps://agentprime.io/advisories/CVE-2026-30845/https://agentprime.io/advisories/CVE-2026-30845/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Mar 2026 19:34:28 GMTCVECVE-2026-30844: Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loadinghttps://agentprime.io/advisories/CVE-2026-30844/https://agentprime.io/advisories/CVE-2026-30844/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Mar 2026 19:33:06 GMTCVEcriticalCVE-2026-30843: Wekan has Cross-Board IDOR in Custom Fields Update Endpointshttps://agentprime.io/advisories/CVE-2026-30843/https://agentprime.io/advisories/CVE-2026-30843/CVSS 9.3 (Critical). Critical: CVSS score 9.3: 9.0 or more. Published by the CVE Program. Not analysed by agentprime yet.Fri, 06 Mar 2026 19:30:38 GMTCVEcriticalCVE-2026-2209: WeKan Custom Translation translationBody.js setCreateTranslation improper authorizationhttps://agentprime.io/advisories/CVE-2026-2209/https://agentprime.io/advisories/CVE-2026-2209/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 08 Feb 2026 01:14:34 GMTCVECVE-2026-2208: WeKan Rules rules.js RulesBleed authorizationhttps://agentprime.io/advisories/CVE-2026-2208/https://agentprime.io/advisories/CVE-2026-2208/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 08 Feb 2026 01:09:41 GMTCVECVE-2026-2207: WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosurehttps://agentprime.io/advisories/CVE-2026-2207/https://agentprime.io/advisories/CVE-2026-2207/CVSS 6.9 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 08 Feb 2026 01:09:38 GMTCVECVE-2026-2206: WeKan Administrative Repair fixDuplicateLists.js FixDuplicateBleed access controlhttps://agentprime.io/advisories/CVE-2026-2206/https://agentprime.io/advisories/CVE-2026-2206/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 08 Feb 2026 01:09:36 GMTCVECVE-2026-2205: WeKan Meteor Publication cards.js CardPubSubBleed information disclosurehttps://agentprime.io/advisories/CVE-2026-2205/https://agentprime.io/advisories/CVE-2026-2205/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sun, 08 Feb 2026 01:09:32 GMTCVECVE-2026-25859: WeKan < 8.20 Migration Functionality Insufficient Permission Checkshttps://agentprime.io/advisories/CVE-2026-25859/https://agentprime.io/advisories/CVE-2026-25859/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Feb 2026 21:59:42 GMTCVECVE-2026-25568: WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypasshttps://agentprime.io/advisories/CVE-2026-25568/https://agentprime.io/advisories/CVE-2026-25568/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Feb 2026 21:59:13 GMTCVECVE-2026-25567: WeKan < 8.19 Card Comment Author Spoofing via User-controlled authorIdhttps://agentprime.io/advisories/CVE-2026-25567/https://agentprime.io/advisories/CVE-2026-25567/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Feb 2026 21:58:53 GMTCVECVE-2026-25566: WeKan < 8.19 Cross-board Card Move Without Destination Authorizationhttps://agentprime.io/advisories/CVE-2026-25566/https://agentprime.io/advisories/CVE-2026-25566/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Feb 2026 21:58:33 GMTCVECVE-2026-25565: WeKan < 8.19 Read-only Board Roles Can Update Cardshttps://agentprime.io/advisories/CVE-2026-25565/https://agentprime.io/advisories/CVE-2026-25565/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Feb 2026 21:58:13 GMTCVECVE-2026-25564: WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validationhttps://agentprime.io/advisories/CVE-2026-25564/https://agentprime.io/advisories/CVE-2026-25564/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Feb 2026 21:57:51 GMTCVECVE-2026-25563: WeKan < 8.19 Checklist Creation Cross-Board IDORhttps://agentprime.io/advisories/CVE-2026-25563/https://agentprime.io/advisories/CVE-2026-25563/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Feb 2026 21:57:32 GMTCVECVE-2026-25562: WeKan < 8.19 Attachments Publication Information Disclosurehttps://agentprime.io/advisories/CVE-2026-25562/https://agentprime.io/advisories/CVE-2026-25562/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Feb 2026 21:57:12 GMTCVECVE-2026-25561: WeKan < 8.19 Attachment Upload Object Relationship Validation Bypasshttps://agentprime.io/advisories/CVE-2026-25561/https://agentprime.io/advisories/CVE-2026-25561/CVSS 7.1 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Feb 2026 21:56:52 GMTCVECVE-2026-25560: WeKan < 8.19 LDAP Authentication Filter Injectionhttps://agentprime.io/advisories/CVE-2026-25560/https://agentprime.io/advisories/CVE-2026-25560/CVSS 8.7 (High). Published by the CVE Program. Not analysed by agentprime yet.Sat, 07 Feb 2026 21:56:19 GMTCVECVE-2026-1964: WeKan REST Endpoint boards.js BoardTitleRESTBleed access controlhttps://agentprime.io/advisories/CVE-2026-1964/https://agentprime.io/advisories/CVE-2026-1964/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Feb 2026 21:32:07 GMTCVECVE-2026-1963: WeKan Attachment Storage attachments.js MoveStorageBleed access controlhttps://agentprime.io/advisories/CVE-2026-1963/https://agentprime.io/advisories/CVE-2026-1963/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Feb 2026 21:02:07 GMTCVECVE-2026-1962: WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access controlhttps://agentprime.io/advisories/CVE-2026-1962/https://agentprime.io/advisories/CVE-2026-1962/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Feb 2026 20:32:08 GMTCVECVE-2026-1898: WeKan LDAP User Sync syncUser.js SyncLDAPBleed access controlhttps://agentprime.io/advisories/CVE-2026-1898/https://agentprime.io/advisories/CVE-2026-1898/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Feb 2026 00:32:09 GMTCVECVE-2026-1897: WeKan Position-History Tracking positionHistory.js PositionHistoryBleed authorizationhttps://agentprime.io/advisories/CVE-2026-1897/https://agentprime.io/advisories/CVE-2026-1897/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 05 Feb 2026 00:02:07 GMTCVECVE-2026-1896: WeKan Migration Operation comprehensiveBoardMigration.js ComprehensiveBoardMigration MigrationBleed access controlhttps://agentprime.io/advisories/CVE-2026-1896/https://agentprime.io/advisories/CVE-2026-1896/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Feb 2026 23:32:08 GMTCVECVE-2026-1895: WeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access controlhttps://agentprime.io/advisories/CVE-2026-1895/https://agentprime.io/advisories/CVE-2026-1895/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Feb 2026 23:02:08 GMTCVECVE-2026-1894: WeKan REST API checklistItems.js Checklist REST Bleed improper authorizationhttps://agentprime.io/advisories/CVE-2026-1894/https://agentprime.io/advisories/CVE-2026-1894/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Feb 2026 22:32:08 GMTCVECVE-2026-1892: WeKan REST API boards.js setBoardOrgs improper authorizationhttps://agentprime.io/advisories/CVE-2026-1892/https://agentprime.io/advisories/CVE-2026-1892/CVSS 2.3 (Low). Published by the CVE Program. Not analysed by agentprime yet.Wed, 04 Feb 2026 22:02:10 GMTCVE