Threat database

CVE-2026-108549 is a critical vulnerability in chenhg5 cc-connect up to version 1.5.0. It involves missing authentication in the MAX platform adapter webhook mode, allowing unauthenticated remote attackers to send forged updates to the webhook listener on port 8080. This can enable attackers to execute privileged commands such as /shell on the host system.

CVE-2026-92801 is a high-severity vulnerability in chenhg5 cc-connect up to version 1.5.0. The flaw involves incorrect authorization where the onCardAction handler for Feishu interactive card callbacks does not enforce per-user allowlist filtering. This allows attackers to dispatch agent commands by triggering card actions in admitted chats, bypassing intended per-user access controls.

CVE-2026-76761 is an OS command injection vulnerability in chenhg5 cc-connect versions 1.4.0 and 1.4.1. It affects the shellExecCommand function in the core/engine.go file of the Management API component. The vulnerability allows remote attackers to manipulate the exec argument to execute arbitrary OS commands. Exploit code is publicly available, but there is no indication of active exploitation in the wild. The issue was reported but the related GitHub issue was closed due to inactivity.

CVE-2026-76760 is a code injection vulnerability in the Authenticate function of the core/webhook.go file in chenhg5 cc-connect versions 1.4.0 and 1.4.1. The vulnerability allows remote attackers to manipulate the exec argument, leading to code injection. The exploit has been publicly disclosed, but there is no indication of active exploitation in the wild. The vulnerability has a medium severity rating with a CVSS score of 6.9.