https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 08 Nov 2026 06:26:16 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-123515 <p>Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers&#39; clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.</p> <p>Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers&#39; clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.</p> https://db.gcve.eu/vuln/fkie_cve-2026-123515 https://db.gcve.eu/vuln/ghsa-v3ff-w4v5-fqw6 <p>Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers&#39; clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.</p> <p>Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers&#39; clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.</p> https://db.gcve.eu/vuln/ghsa-v3ff-w4v5-fqw6