CVE WATCH / VULNERABILITY DETAIL
CVE-2026-123508
LOWCVSS 3.1NVD feed
Published 8 November 2026 · tracked since 8 November 2026
Description
Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries ship
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog