PT-2026-38585 · Vvveb · Vvveb

Basant Kumar + 2 · CVE-2026-41928 · Published 2026-05-07 · Updated 2026-05-10

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.2

Description An information disclosure issue exists in the cron controller that allows unauthenticated attackers to retrieve the application's secret cron key. By accessing the cron controller without authentication, an attacker can obtain the exposed secret key from the response, which enables the triggering of scheduled task execution outside of the intended schedule.

Recommendations Update to version 1.0.8.2 or later.

Exploit

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2026-41928

Affected Products

Vvveb

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/41xxx/CVE-2026-41928.json · Exploit
• https://github.com/givanz/Vvveb/commit/517bc09faf44136e72de391aacc8b90a706f7ae7 · Patch
• https://osv.dev/vulnerability/CVE-2026-41928 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-41928 · Security Note
• https://github.com/givanz/Vvveb · Note
• https://t.me/CVEtracker/53037 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2052614714400653634 · Twitter Post
• https://vulncheck.com/advisories/vvveb-information-disclosure-via-cron-controller · Note
• https://twitter.com/CVEnew/status/2053559191562748353 · Twitter Post