https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-16T22:36:03.935436+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-110628 fkie_cve-2026-110628 2026-10-16T22:36:03.936271+00:00

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.

 https://db.gcve.eu/vuln/ghsa-8p5c-vr7c-5g49 GHSA-8p5c-vr7c-5g49 2026-10-16T22:36:03.936318+00:00

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.