https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-05T05:09:52.330541+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-121545 fkie_cve-2026-121545 2026-11-05T05:09:52.332526+00:00

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.

 https://db.gcve.eu/vuln/ghsa-vwg6-vcv8-xg59 GHSA-vwg6-vcv8-xg59 2026-11-05T05:09:52.332624+00:00

Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.