https://db.gcve.eu/rss/recent/all/10 Most recent entries from all 2026-11-05T14:14:27.019935+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/cve-2026-121557 CVE-2026-121557 — WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot 2026-11-05T14:14:27.023073+00:00

Affected: wppconnect-server

WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.