Vendor

    WeKan

    39 known vulnerabilities in products by WeKan, 0 of them actively exploited (CISA KEV).

    Key figures

    39

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    6

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in WeKan
    HighCVE-2021-3309

    WeKan: security vulnerability

    		8.1
    CriticalCVE-2026-25560

    WeKan < 8.19 LDAP Authentication Filter Injection

    also in 1 other product

    		9.8
    HighCVE-2026-25859

    WeKan < 8.20 Migration Functionality Insufficient Permission Checks

    also in 1 other product

    		8.8
    MediumCVE-2018-1000549

    WeKan: security vulnerability

    		5.3
    HighCVE-2026-30846

    Wekan Exposes All Global Webhook Integrations through globalwebhooks Publication

    also in 1 other product

    		7.5
    CriticalCVE-2026-30847

    Wekan Credential Leak via notificationUsers Publication Exposes Password Hashes and Session Tokens

    also in 1 other product

    		6.5
    CriticalCVE-2026-30844

    Wekan Vulnerable to SSRF through Lack of Validation or Filtering in Attachment URL Loading

    also in 1 other product

    		8.1
    CriticalCVE-2026-30843

    Wekan has Cross-Board IDOR in Custom Fields Update Endpoints

    also in 1 other product

    		6.5
    HighCVE-2025-65780

    WeKan: Privilege Escalation

    		8.8
    HighCVE-2025-65778

    WeKan: Cross-Site Request Forgery (CSRF)

    		8.1
    HighCVE-2026-30845

    Wekan Exposes Sensitive Data through Lack of Field Filtering During Board Publication

    also in 1 other product

    		8.2
    MediumCVE-2023-28485

    WeKan: Cross-Site Scripting (XSS)

    		5.4
    HighCVE-2025-65781

    WeKan: Spoofing

    		8.2
    MediumCVE-2026-2207

    WeKan Activity Publication activities.js LinkedBoardActivitiesBleed information disclosure

    		5.3
    HighCVE-2026-25563

    WeKan < 8.19 Checklist Creation Cross-Board IDOR

    also in 1 other product

    		7.5
    HighCVE-2026-25561

    WeKan < 8.19 Attachment Upload Object Relationship Validation Bypass

    also in 1 other product

    		7.5
    HighCVE-2026-25564

    WeKan < 8.19 Checklist Deletion IDOR via Missing Relationship Validation

    also in 1 other product

    		7.5
    HighCVE-2025-65779

    WeKan: security vulnerability

    		7.5
    HighCVE-2026-25565

    WeKan < 8.19 Read-only Board Roles Can Update Cards

    also in 1 other product

    		6.5
    CriticalCVE-2026-1962

    WeKan Attachment Migration attachmentMigration.js AttachmentMigrationBleed access control

    		6.3
    CriticalCVE-2026-1963

    WeKan Attachment Storage attachments.js MoveStorageBleed access control

    		6.3
    HighCVE-2026-25566

    WeKan < 8.19 Cross-board Card Move Without Destination Authorization

    also in 1 other product

    		5.4
    MediumCVE-2021-20654

    Wekan: Cross-site Scripting

    		5.4
    HighCVE-2026-25568

    WeKan < 8.19 allowPrivateOnly Setting Enforcement Bypass

    also in 1 other product

    		4.3
    MediumCVE-2026-1896

    WeKan: Incorrect Privilege Assignment

    		6.3

    All vulnerabilities in search

    Products

    Products by WeKan
    WeKan390