CVE-2026-123508

Vikunja versions before 2.7.1 are susceptible to a supply chain risk due to the use of mutable latest references when fetching the xgo module and Docker image within the mage release targets. An attacker who successfully compromises the upstream xgo module, the image itself, or the registry can i...

CVE-2024-2563

A vulnerability has been found in PandaXGO PandaX up to 20240310 and classified as critical. This vulnerability affects the function DeleteImage of the file /apps/system/router/upload.go. The manipulation of the argument fileName with the input ../../../../../../../../../tmp/1.txt leads to path...

PT-2024-21041 · Unknown · Pandaxgo Pandax

Name of the Vulnerable Software and Affected Versions: PandaXGO PandaX up to 20240310 Description: A critical issue was found in the function InsertRole of the file /apps/system/services/role menu.go. The manipulation of the argument roleKey leads to sql injection. It is possible to initiate the...