CVE-2026-110799

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to version 1.0.8.7, the password reset functionality is vulnerable to an Authentication Bypass due to insufficient validation of the user and token GET parameters. This issue has been patched in version 1.0.8.7.

• CWE-287

• https://github.com/givanz/Vvveb/security/advisories/GHSA-qw5g-hcm8-9jcj
• https://github.com/givanz/Vvveb/security/advisories/GHSA-qw5g-hcm8-9jcj

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-110773GrowChief through 0.3.0 contains a missing authorization vul…4.3
• CVE-2026-110774Blinko through 1.8.8 contains a broken access control vulner…5.3
• CVE-2026-110775Nexent through 2.7.0 contains a missing authorization vulner…6.5
• CVE-2026-110777A flaw was found in evolution-data-server. Calendar events c…5.7
• CVE-2026-11078Inappropriate implementation in FileSystem in Google Chrome …6.5
• CVE-2026-11079Insufficient validation of untrusted input in Codecs in Goog…8.8
• CVE-2026-1108A security vulnerability has been detected in cijliu librtsp…7.8
• CVE-2026-11080Use after free in WebView in Google Chrome on Android prior …8.8
• CVE-2026-110803VaadinService.requestEnd() in Vaadin Framework 8 locks the s…8.7
• CVE-2026-110804Improperly controlled modification of JIT elevation settings…4.3
• CVE-2026-110805Server-side request forgery in PingOne groups endpoint in De…2.6
• CVE-2026-110806Incorrect authorization in add-on properties in Devolutions …6.5