https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 10 Nov 2026 03:04:27 +0000 https://db.gcve.eu/vuln/cve-2026-123515 <p><strong>Affected:</strong> go-vikunja vikunja</p> <p>Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers&#39; clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.</p> <p><strong>Affected:</strong> go-vikunja vikunja</p> <p>Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make viewers&#39; clients request loopback or LAN addresses by storing img elements in rich text. Attackers can plant images in tasks, comments, project descriptions, or imported Markdown to trigger blind GET requests against local services and track when viewers open content.</p> https://db.gcve.eu/vuln/cve-2026-123515