https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-17T05:04:32.180767+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-110628 CVE-2026-110628 — Kan 0.5.5 through 0.6.0 Unauthenticated SSRF via /api/download/attatchment 2026-10-17T05:04:32.182182+00:00

Affected: kanbn kan

Kan 0.5.5 through 0.6.0 contains an unauthenticated server-side request forgery vulnerability in the /api/download/attatchment route due to an incomplete fix for CVE-2026-32255. When S3_ENDPOINT is unset, attackers can pass arbitrary url query parameters to fetch() to read internal services, localhost ports, and cloud instance metadata.