| CVE-2026-118264 | CRITICAL | github.com/labstack/echo/v4 | v4.15.4 | 4.16.1 | Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ... |
| CVE-2026-118264 | CRITICAL | github.com/labstack/echo/v5 | v5.3.1 | 5.4.1 | Echo is a Go web framework. From 4.0.0 until 4.16.1 and 5.4.1, Echo's ... |
| CVE-2026-116587 | HIGH | github.com/go-jose/go-jose/v4 | v4.1.4 | 4.1.6 | Go JOSE: DoS when parsing JWKs that contain RSA keys |
| CVE-2026-118260 | HIGH | github.com/labstack/echo/v4 | v4.15.4 | 4.16.1 | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ... |
| CVE-2026-118261 | HIGH | github.com/labstack/echo/v4 | v4.15.4 | 4.16.1 | Echo is a Go web framework. From 4.0.0 until 4.16.1, Echo v4's opt-in ... |
| CVE-2026-118262 | HIGH | github.com/labstack/echo/v4 | v4.15.4 | 4.16.1 | Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ... |
| CVE-2026-118262 | HIGH | github.com/labstack/echo/v5 | v5.3.1 | 5.4.1 | Echo is a Go web framework. From 4.15.0 until 4.16.1 and 5.4.1, Echo's ... |
| CVE-2026-118650 | HIGH | github.com/labstack/echo/v4 | v4.15.4 | 4.16.0 | Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path |
| CVE-2026-118650 | HIGH | github.com/labstack/echo/v5 | v5.3.1 | 5.4.0 | Echo's middleware.Static: `%2F`-encoded path bypasses route/group middleware guarding a statically-served path |
| GHSA-m687-p538-r5hp | HIGH | code.vikunja.io/api | 2.6.0 | — sin corrección | Vikunja: Permissive Cross-domain Security Policy trusts every localhost origin which should not be trusted |
| CVE-2026-114437 | MEDIUM | github.com/go-chi/chi/v5 | v5.3.1 | 5.4.0 | github.com/go-chi/chi: chi: client IP spoofing via unverified direct connection in ClientIPFromXFF middleware |
| CVE-2026-116585 | MEDIUM | github.com/go-jose/go-jose/v4 | v4.1.4 | 4.1.5 | Go JOSE: Panic during CBC-HMAC processing |
| CVE-2026-116586 | MEDIUM | github.com/go-jose/go-jose/v4 | v4.1.4 | 4.1.5 | Go JOSE: Panics in JSON parsing |
| CVE-2026-118263 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.1 | Echo: BodyDump can discard BodyLimit overflow errors for unknown-length requests |
| CVE-2026-118265 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.1 | Echo: X-Real-IP extractor trusts the header value instead of the sending peer |
| CVE-2026-118266 | MEDIUM | github.com/labstack/echo/v4 | v4.15.4 | 4.16.0 | Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method |
| CVE-2026-118266 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.0 | Echo has CSRF Protection Bypass via MethodOverride Rewriting POST to Safe Method |
| CVE-2026-118651 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.0 | Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default |
| CVE-2026-118652 | MEDIUM | github.com/labstack/echo/v4 | v4.15.4 | 4.16.0 | Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob |
| CVE-2026-118652 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.0 | Echo vulnerable to Reflected Cross-Site Scripting (XSS) via unsanitized JSONP callback in Context.JSONP / Context.JSONPBlob |
| CVE-2026-118654 | MEDIUM | github.com/labstack/echo/v4 | v4.15.4 | 4.16.0 | Echo static file middleware route protection bypass via encoded dot-dot traversal |
| CVE-2026-118654 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.0 | Echo static file middleware route protection bypass via encoded dot-dot traversal |
| CVE-2026-118656 | MEDIUM | github.com/labstack/echo/v4 | v4.15.4 | 4.16.0 | Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI |
| CVE-2026-118656 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.0 | Echo has Open Redirect via Control-Character Prefix Defeating sanitizeURI |
| CVE-2026-118657 | MEDIUM | github.com/labstack/echo/v4 | v4.15.4 | 4.16.0 | Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers |
| CVE-2026-118657 | MEDIUM | github.com/labstack/echo/v5 | v5.3.1 | 5.4.0 | Echo: HTTPS Redirect and HSTS Bypass via Unconditional Trust of Forwarded Scheme Headers |
| GHSA-4hv6-xc92-j86g | MEDIUM | code.vikunja.io/api | 2.6.0 | 2.7.0 | Vikunja: WebSocket authentication ignores server-side session state, so revoked sessions keep receiving live pushes |
| GHSA-fmmf-xq98-g327 | MEDIUM | code.vikunja.io/api | 2.6.0 | 2.7.0 | Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check |
| GHSA-fprf-r6rv-xg99 | MEDIUM | code.vikunja.io/api | 2.6.0 | 2.7.0 | Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants |
| GHSA-pjr3-86v4-5p7w | MEDIUM | code.vikunja.io/api | 2.6.0 | 2.7.0 | Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0) |
| CVE-2026-118651 | MEDIUM | github.com/labstack/echo/v4 | v4.15.4 | — sin corrección | Echo: Reverse Proxy Forwards Attacker-Supplied X-Real-IP to Upstream by Default |
| CVE-2026-118653 | MEDIUM | github.com/labstack/echo/v4 | v4.15.4 | — sin corrección | Echo has Rate Limiter Bypass via Spoofed X-Forwarded-For Header in Default Configuration |
| GHSA-hjx8-qv73-f7cm | MEDIUM | code.vikunja.io/api | 2.6.0 | — sin corrección | Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed |
| CVE-2023-36308 | LOW | github.com/disintegration/imaging | v1.6.2 | — sin corrección | disintegration Imaging 1.6.2 allows attackers to cause a panic (becaus ... |
| CVE-2026-78661 | UNKNOWN | golang.org/x/net | v0.60.0 | 0.62.0 | When coalescing adjacent text nodes in addText and fosterParent, appen ... |
| CVE-2026-97045 | UNKNOWN | golang.org/x/net | v0.60.0 | 0.62.0 | In childTextNodesAreLiteral, walking up the tree previously stopped at ... |
| GO-2026-5932 | UNKNOWN | golang.org/x/crypto | v0.57.0 | — sin corrección | The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues |
