webreaper vulnerabilities

Products

• webreaper/damselfly 1

Latest webreaper CVEs

Newest publication first

1. CVE-2026-111626 Webreaper Damselfly through 4.5.3 Missing Authentication on REST API Controllers

   Published 2026-10-16

   Critical·CVSS 9.3 EPSS 0.45%

   Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers to access all /api/* routes because controller authorization attributes are commented out. Attackers can send PUT /api/users with Admin roles to create administ...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.