low · CVSS v3 3.3 · CVSS v4 1

CVE-2026-123510

Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and lo…

Description

Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and logs to be written in the startup working directory. Local attackers able to write to that directory can plant plugins loaded into the server when plugins are enabled, or read misplaced logs including audit.log.

Scores

Severity
low
CVSS v2
2.4
CVSS v3
3.3
CVSS v4
1
EPSS
—

← All CVEs

Related CVEs

low

CVE-2026-123498

Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft ProjectTitle or task descriptions that the prime hook loads on SessionStart and PreCompact, causing the agent to modify the developer's checkout or run commands.

View analysis

low

CVE-2026-123508

Vikunja before 2.7.1 contains a supply chain vulnerability in its mage release targets that fetch the xgo module and Docker image by mutable latest references. Attackers who compromise the upstream xgo module, image, or registry can inject malicious code into subsequently built release binaries shipped under a valid signature.

View analysis

low

CVE-2026-123540

OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to alter attribute values by injecting unencoded content into the service provider auto-submitted form. Attackers controlling a trusted identity provider can craft assertion attribute names or values that reach the target application in modified form, undermining the integrity of received attributes.

View analysis

low

CVE-2026-17062

IBM API Connect versions 10.0.8.0‑10.0.8.12 and 12.1.0.0‑12.1.1.2 allow a remote authenticated attacker to inject additional parameters into internal requests due to unsafe handling of special characters. This can alter request behavior and potentially expose sensitive data. The vulnerability is low severity but still requires attention.

View analysis