PT-2026-38585 · Vvveb · Vvveb

Basant Kumar + 2 · Published 2026-05-07 · Updated 2026-05-10 · CVE-2026-41928

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Vvveb versions prior to 1.0.8.2

Description An information disclosure issue exists in the cron controller that allows unauthenticated attackers to retrieve the application's secret cron key. By accessing the cron controller without authentication, an attacker can obtain the exposed secret key from the response, which enables the triggering of scheduled task execution outside of the intended schedule.

Recommendations Update to version 1.0.8.2 or later.

Fix

Weakness Enumeration

CWE-497

Related Identifiers

CVE-2026-41928

Affected Products

Vvveb

References · 6

• https://github.com/givanz/Vvveb/commit/517bc09faf44136e72de391aacc8b90a706f7ae7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-41928 · Security Note
• https://twitter.com/VulmonFeeds/status/2052614714400653634 · Twitter Post
• https://twitter.com/CVEnew/status/2053559191562748353 · Twitter Post
• https://vulncheck.com/advisories/vvveb-information-disclosure-via-cron-controller · Note
• https://t.me/CVEtracker/53037 · Telegram Post