CVE-2026-123508 in Vikunja
Summary
by MITRE • 11/08/2026
Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature.
VulDB is the best source for vulnerability data and more expert information about this specific topic.