https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T21:14:23.811450+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-123497 fkie_cve-2026-123497 2026-11-10T21:14:23.814645+00:00

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.

 https://db.gcve.eu/vuln/ghsa-rg35-8p7r-mq2v GHSA-rg35-8p7r-mq2v 2026-11-10T21:14:23.814764+00:00

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.