https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-10T20:53:26.304535+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-123497 CVE-2026-123497 — Vikunja veans before 2.7.1 HTTPS to HTTP Downgrade in Server Discovery 2026-11-10T20:53:26.305318+00:00

Affected: go-vikunja vikunja

Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path attackers to force plain HTTP during veans init and login. Attackers can block HTTPS ports so discovery accepts an unverified HTTP response, capturing passwords, TOTP codes or bot tokens and persisting cleartext API traffic.