CVE-2026-123508
LOWDescription
Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature.
Is your site exposed to CVE-2026-123508?
Run a free security scan — no signup, results in seconds.
CVSS v3.1 Score
EPSS — Exploit Prediction
EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.
Weakness Type (CWE)
References
Frequently Asked Questions
What is CVE-2026-123508? +
How severe is CVE-2026-123508? +
How do I check if I'm vulnerable to CVE-2026-123508? +
Related Vulnerabilities
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.12, download_wheel() accepts pip and setuptools seed wheels …
DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead …
Update components download and execute code without proper authenticity verification, relying on ignored hashes or forgeable checksums. Some update paths …
The application implements software update functionality without adequate authenticity and integrity validation, allowing update packages to be accepted without sufficient …
virtualenv is a tool for creating isolated virtual python environments. Prior to 21.14.9, PipInvoke.get_pip_install_cmd() handles --seeder pip --download by calling …
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup …
