CVE-2026-41928

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-41928

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41928.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-41928

Published

2026-05-07T21:13:13.870Z

Modified

2026-07-16T03:31:13.867574663Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Vvveb < 1.0.8.2 Information Disclosure via Cron Controller

Details

Vvveb before 1.0.8.2 contains an information disclosure vulnerability in the cron controller that allows unauthenticated attackers to retrieve the application's secret cron key. Attackers can access the cron controller without authentication and retrieve the exposed secret key from the response, enabling them to trigger scheduled task execution outside of the intended schedule.

Database specific

{
    "cwe_ids": [
        "CWE-497"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41928.json",
    "cna_assigner": "VulnCheck"
}

References

Affected packages

Git / github.com/givanz/vvveb

Affected ranges

Type

GIT

Repo

https://github.com/givanz/vvveb

Events

Introduced

Fixed

8b9db6a408ba35d8ac1dd078823c73f76584d78f

Fixed

517bc09faf44136e72de391aacc8b90a706f7ae7

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.8.2"
        }
    ],
    "source": [
        "DESCRIPTION",
        "REFERENCES"
    ]
}

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

1.0.7

1.0.7.1

1.0.7.2

1.0.7.3

1.0.8

1.0.8.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-41928.json"