EUVD-2026-63172

A vulnerability was found in chenhg5 cc-connect up to 1.4.1. Affected by this vulnerability is the function Authenticate of the file core/webhook.go. The manipulation of the argument exec results in code injection. The attack may be performed from remote. The exploit has been made public and coul...

CVE-2026-76760

In chenhg5 cc-connect up to version 1.4.1, the Authenticate function in core/webhook.go injects the attacker-controlled exec argument directly into command execution, enabling unauthenticated remote code injection over the network. CVSS 3.1 rates this HIGH (7.3). No patch version or exploit detai...

Server-side Request Forgery (SSRF)

Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the fireWebhook function in the file /internal/service/webhook/webhook.go. An attacker can cause the server to initiate arbitrary requests to internal or external systems by supplying crafted input t...