https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-10-16T21:24:14.243369+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/fkie_cve-2026-110617 fkie_cve-2026-110617 2026-10-16T21:24:14.246914+00:00

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mp_id and guessable timestamp-based export filename to retrieve archives under data/docs, and set delete_after_download=true to delete them.

 https://db.gcve.eu/vuln/ghsa-h2vr-gxjh-m386 GHSA-h2vr-gxjh-m386 2026-10-16T21:24:14.247016+00:00

we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented out. Attackers can supply an mp_id and guessable timestamp-based export filename to retrieve archives under data/docs, and set delete_after_download=true to delete them.