doist 相關的公開 CVE 漏洞與安全風險資訊，提供 CVSS、EPSS、公開時間與漏洞情報資料，協助評估潛在風險與修補優先順序。
| CVE | 摘要 | 來源 | 最高 CVSS | EPSS % | 公開時間 | 更新時間 |
|---|---|---|---|---|---|---|
| CVE-2025-63317 | Todoist v8896 is vulnerable to Cross Site Scripting (XSS) in /api/v1/uploads. Uploaded SVG files have no sanitization applied, so embedded JavaScript executes when a user opens the attachment from a task/comment. | [email protected] | 5.4 | 0.18% | 2025-12-01 | 2026-06-17 |
| CVE-2025-57292 | Todoist v8484 contains a stored cross-site scripting (XSS) vulnerability in the avatar upload functionality. The application fails to properly validate the MIME type and sanitize image metadata. | [email protected] | 6.1 | 0.22% | 2025-09-26 | 2026-06-17 |