CVE-2026-26957

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: Upon further research, the maintainer determined that the behavior described by the CVE record is intended behavior. Per the GitHub Security Advisory: "Libredesk is a single-tenant, self-hosted application. Configuring outbound webhook URLs requires an admin-only permission that is not granted by default - the operator must explicitly assign it. Anyone holding this permission already has full administrative control over the application, and outbound HTTP to operator-chosen URLs is the documented purpose of the webhook feature. This is working as designed." Notes: none.

Published

Feb 20, 2026

Last Modified

Jun 9, 2026

Status

Rejected

• CVE-2026-26951Dell PowerProtect Data Domain, versions 7.7.1.0 through 8.6,…6.7
• CVE-2026-26952Pi-hole Admin Interface is a web interface for managing Pi-h…5.4
• CVE-2026-26953Pi-hole Admin Interface is a web interface for managing Pi-h…5.4
• CVE-2026-26954SandboxJS is a JavaScript sandboxing library. Prior to 0.8.3…10
• CVE-2026-26955FreeRDP is a free implementation of the Remote Desktop Proto…8.8
• CVE-2026-26956vm2 is an open source vm/sandbox for Node.js. In version 3.1…9.8
• CVE-2026-26958filippo.io/edwards25519 is a Go library implementing the edw…1.7
• CVE-2026-26959ADB Explorer is a fluent UI for ADB on Windows. Versions 0.9…7.8
• CVE-2026-2696The Export All URLs WordPress plugin before 5.1 generates CS…5.3
• CVE-2026-26960node-tar is a full-featured Tar for Node.js. When using defa…7.1
• CVE-2026-26961Rack is a modular Ruby web server interface. Prior to versio…5.3
• CVE-2026-26962Rack is a modular Ruby web server interface. From version 3.…6.5