https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-11T11:00:43.426254+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-108549 fkie_cve-2026-108549 2026-10-11T11:00:43.428505+00:00

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.

 https://vulnerability.circl.lu/vuln/ghsa-h8j8-r6g6-37hc GHSA-h8j8-r6g6-37hc 2026-10-11T11:00:43.428659+00:00

cc-connect through 1.5.0 contains a missing authentication vulnerability in the MAX platform adapter webhook mode in platform/max/max.go that accepts unauthenticated updates when no webhook_secret is configured. Remote attackers reaching the webhook listener on port 8080 can forge updates with an allowed or admin user_id to run privileged commands like /shell on the host.