8
CVEs
0
Critical
8
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.4%
Avg EPSS
Severity Breakdown
CRITICAL
0
HIGH
8
MEDIUM
0
LOW
0
Monthly CVE Trend
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-49221 | Broken object-level authorization in Vvveb CMS prior to 1.0.8.4 allows an authenticated low-privilege Vendor to access, modify, or delete digital assets belonging to any other Vendor by supplying arbitrary digital_asset_id values to the admin digital asset controllers. The flaw spans listing, read, edit, and delete operations across both MySQL and PostgreSQL backends, enabling cross-tenant metadata disclosure, resource link corruption, and permanent data loss. No public exploit code or CISA KEV listing exists at time of analysis, but exploitation is technically trivial for any authenticated Vendor in a multi-vendor deployment. | HIGH | 8.8 | 0.4% | 44 |
|
| CVE-2026-49228 | Insecure Direct Object Reference in Vvveb CMS prior to 1.0.8.4 allows any authenticated low-privileged Vendor to read, duplicate, or delete products belonging to other Vendors by submitting arbitrary product_id values in backend product operations. The root cause is that the products.php controller passes caller-controlled product_id values to SQL operations without consistently enforcing admin_id scoping - the fix required adding conditional admin_id filtering across six DELETE statements in both MySQL and PostgreSQL query files. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, but the low exploitation complexity makes it a meaningful business-logic risk for any multi-vendor Vvveb deployment. | HIGH | 8.8 | 0.4% | 44 |
|
| CVE-2026-49224 | Post revision operations in Vvveb CMS prior to 1.0.8.4 expose an Insecure Direct Object Reference that allows any authenticated Author-role user to read, restore, or delete revision records belonging to other authors. The affected controller passes caller-supplied post_id, language_id, and created_at values directly to SQL queries without enforcing admin_id ownership, enabling cross-author access across list, read, restore, and delete operations. No public exploit code has been identified at time of analysis, and a vendor-released patch is available in version 1.0.8.4. | HIGH | 8.3 | 0.4% | 42 |
|
| CVE-2026-49225 | Insecure direct object reference in Vvveb CMS prior to 1.0.8.4 allows any authenticated Vendor-role user to read, restore, and delete product revision records belonging to other Vendors by supplying arbitrary caller-controlled product_id values to the backend revision controller. All Vvveb multi-vendor deployments running versions before 1.0.8.4 are affected across MySQL, PostgreSQL, and SQLite database backends. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but the low barrier to entry - only a valid Vendor session is required - makes lateral abuse within shared storefronts realistic. | HIGH | 8.3 | 0.4% | 42 |
|
| CVE-2026-49226 | Insecure Direct Object Reference (IDOR) in Vvveb CMS prior to 1.0.8.4 enables any authenticated Author-role user to bypass ownership enforcement and access, duplicate, or permanently delete posts belonging to other authors. The PHP controller `admin/controller/content/posts.php` accepts a caller-controlled `filter[admin_id]` parameter that overrides the server-assigned identity restriction, and the underlying SQL layer (MySQL, PostgreSQL, and SQLite backends) lacked consistent `admin_id` enforcement on delete and list operations. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog, but the patch is available as of release 1.0.8.4. | HIGH | 8.3 | 0.3% | 42 |
|
| CVE-2026-49227 | Insecure Direct Object Reference (IDOR) in Vvveb CMS prior to 1.0.8.4 allows authenticated low-privileged Authors to perform unauthorized comment operations across author boundaries in the admin backend. The admin/controller/content/comment.php and comments.php controllers accept caller-controlled comment_id values without validating that the referenced comment's parent post belongs to the requesting author, enabling cross-author comment enumeration, content manipulation, status changes, and deletion. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low complexity and network-accessible attack surface make this straightforward for any authenticated low-privilege user to abuse. | HIGH | 7.6 | 0.3% | 38 |
|
| CVE-2026-49222 | Authorization bypass in Vvveb CMS prior to version 1.0.8.4 allows authenticated low-privileged Vendor accounts to perform unauthorized read, edit, status-change, and delete operations on product Q&A entries belonging to other Vendors. The backend SQL query files for all three supported database engines (MySQL, PostgreSQL, SQLite) accepted a caller-controlled product_question_id without joining the product table to verify that the question belongs to a product owned by the current admin_id. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; however, the fix is confirmed in the released version 1.0.8.4 via GitHub advisory GHSA-cjhq-xqq3-6xv8. | HIGH | 7.6 | 0.3% | 38 |
|
| CVE-2026-49223 | Product review management in Vvveb CMS prior to 1.0.8.4 exposes a broken object-level authorization flaw (CWE-639) allowing any authenticated low-privileged Vendor to read, modify, and delete product reviews belonging to other Vendors. The backend SQL queries for all supported database drivers (mysqli, pgsql, sqlite) accept a caller-controlled product_review_id without validating ownership against the requesting admin_id, enabling cross-Vendor review manipulation. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; however, the CVSS 7.6 High score reflects significant integrity impact in multi-vendor marketplace deployments. | HIGH | 7.6 | 0.3% | 38 |
|