Latest high and critical flaws
- CVE-2026-68900 Wekan is open source kanban built with Meteor.High 7.6 · Aug 19, 2026
- CVE-2026-68899 Wekan is open source kanban built with Meteor.High 8.7 · Aug 19, 2026
- CVE-2026-68561 Wekan is open source kanban built with Meteor.High 8.8 · Aug 19, 2026
- CVE-2026-68560 Wekan is open source kanban built with Meteor.High 7.7 · Aug 19, 2026
- CVE-2026-68558 Wekan is open source kanban built with Meteor.High 8.5 · Aug 19, 2026
- CVE-2026-55652 Wekan is open source kanban built with Meteor.Critical 9.8 · Jul 15, 2026
- CVE-2026-55234 Wekan is open source kanban built with Meteor.High 8.5 · Jul 15, 2026
- CVE-2026-53445 Wekan is open source kanban built with Meteor.High 7.1 · Jul 15, 2026
- CVE-2026-53444 Wekan is open source kanban built with Meteor.High 7.6 · Jul 15, 2026
- CVE-2026-52893 Wekan is open source kanban built with Meteor.Critical 9.2 · Jul 15, 2026
- CVE-2026-52891 Wekan is open source kanban built with Meteor.Critical 9.9 · Jul 15, 2026
- CVE-2026-52890 Wekan is open source kanban built with Meteor.High 7.1 · Jul 15, 2026
- CVE-2026-41454 WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform adminiHigh 8.7 · Apr 22, 2026
- CVE-2026-30847 Wekan is an open source kanban tool built with Meteor.Critical 9.3 · Mar 6, 2026
- CVE-2026-30846 Wekan is an open source kanban tool built with Meteor.High 8.7 · Mar 6, 2026
- CVE-2026-30844 Wekan is an open source kanban tool built with Meteor.Critical 9.3 · Mar 6, 2026
- CVE-2026-30843 Wekan is an open source kanban tool built with Meteor.Critical 9.3 · Mar 6, 2026
- CVE-2026-25859 Wekan versions prior to 8.20 allow non-administrative users to access migration functionality due to insufficient permission checks, potentially resulting in unHigh 7.1 · Feb 7, 2026
- CVE-2026-25568 WeKan versions prior to 8.19 contain an authorization logic vulnerability where the instance configuration setting allowPrivateOnly is not sufficiently enforcedHigh 7.1 · Feb 7, 2026
- CVE-2026-25566 WeKan versions prior to 8.19 contain an authorization vulnerability in card move logic.High 7.1 · Feb 7, 2026
- CVE-2026-25565 WeKan versions prior to 8.19 contain an authorization vulnerability where certain card update API paths validate only board read access rather than requiring wrHigh 7.1 · Feb 7, 2026
- CVE-2026-25564 WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes.High 7.1 · Feb 7, 2026
- CVE-2026-25563 WeKan versions prior to 8.19 contain an insecure direct object reference (IDOR) in checklist creation and related checklist routes.High 7.1 · Feb 7, 2026
- CVE-2026-25561 WeKan versions prior to 8.19 contain an authorization weakness in the attachment upload API.High 7.1 · Feb 7, 2026
- CVE-2026-25560 WeKan versions prior to 8.19 contain an LDAP filter injection vulnerability in LDAP authentication.High 8.7 · Feb 7, 2026
Part of our vulnerability database: the whole National Vulnerability Database plus CISA’s exploited list, refreshed twice a day. This is general guidance, not a review of your systems.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.