CVE-2026-41935: Givanz Vvveb

High severity, CVSS 7.1. EPSS: 0.5% chance of exploitation in the next 30 days.

Vvveb before 1.0.8.3 contains an uncontrolled recursion vulnerability in the admin controller dispatch cycle where Base::init() repeatedly invokes permission() on error handlers, causing infinite recursion until PHP memory limits are exhausted. Attackers can send sustained requests to forbidden admin URLs from a low-privilege account to exhaust PHP memory on all workers and cause denial of service to legitimate traffic.

Affected products

• Givanz Vvveb: before 1.0.8.3 (fixed in 1.0.8.3)

Published 2026-05-14. Last modified 2026-07-14.