Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulnerability exists in the Projects module where the `filter` URL parameter is rendered into the DOM without output encoding when the user clicks "Filter." While `<script>` and `<iframe>` are blocked, `<svg>`, `<a>`, and formatting tags (`<h1>`, `<b>`, `<u>`) render without restriction — enabling SVG-based phishing buttons, external redirect links, and content spoofing within the trusted application origin. Version 2.0.0 fixes this issue.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
CVE-2026-27116 Vikunja is an open-source self-hosted task management platform. Prior to version 2.0.0, a reflected HTML injection vulnerability exists in the Projects module where t… https://www.cve.org/CVERecord?id=CVE-2026-27116
Post summary
The text announces a reflected HTML injection vulnerability in Vikunja’s Projects module (pre‑v2.0.0) without mentioning PoC, exploit, or patch details.
CVE-2026-27116: Vikunja HTML Injection: When a 'Filter' Becomes a Phishing Hook A Reflected HTML Injection vulnerability in the Vikunja task management platform allows attackers to inject arbitrary HTML tags into the application's DOM via the filter p... https://cvereports.com/reports/CVE-2026-27116
Post summary
The report discloses a reflected HTML injection in Vikunja that lets attackers inject arbitrary HTML tags through the filter, potentially enabling phishing attacks.
CVE-2026-27116 Reflected HTML Injection Vulnerability in Vikunja Task Management Platform Pre-2.0.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-27116
Post summary
A reflected HTML injection vulnerability (CVE-2026-27116) has been disclosed for Vikunja Task Management Platform versions prior to 2.0.0.
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | vikunja | vikunja | - | - | - |