Most recent entries from all https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 14:08:36 +0000 CVE-2026-121557 — WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot https://db.gcve.eu/vuln/cve-2026-121557 <p><strong>Affected:</strong> wppconnect-server</p> <p>WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.</p> <p><strong>Affected:</strong> wppconnect-server</p> <p>WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.</p> https://db.gcve.eu/vuln/cve-2026-121557