robiningelbrecht vulnerabilities

Products

• robiningelbrecht/dreeve 1

Latest robiningelbrecht CVEs

Newest publication first

1. CVE-2026-121545 Dreeve before 5.8.0 Missing Authentication in Strava Webhook POST Handler

   Published 2026-11-03

   Medium·CVSS 6.9 EPSS 0.21%

   Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.