wppconnect-server vulnerabilities
CVEs whose affected-version data names the wppconnect-server package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-123197Medium· 5.3WPPConnect Server through 2.10.76 Unauthenticated Sticker Media Disclosure via /files
WPPConnect Server through 2.10.76 contains a missing authentication vulnerability that allows unauthenticated attackers to read decrypted sticker media through the /files static mount. Attackers can enumerate Unix timestamps in GET /file…
▾ Sunlitwppconnect · wppconnect-servervia CVEORG
CVE-2026-121557Medium· 5.9WPPConnect Server through 2.10.74 Missing Authentication via /api/:session/chatwoot
WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or…
▾ Sunlitwppconnect · wppconnect-serverEPSS 0.41%via CVEORG