Is CVE-2026-41931 actively exploited?

No active exploitation of CVE-2026-41931 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-41931 be exploited remotely?

Yes. CVE-2026-41931 is exploitable remotely over the network (CVSS attack vector: Network).

What is the CVSS score of CVE-2026-41931?

CVE-2026-41931 has a CVSS score of 5.3 (MEDIUM).

HOME VULNERABILITIESCVE-2026-41931

MEDIUM

CVE-2026-41931

CWE-209Published: May 6, 2026· Updated: May 6, 2026

5.3

CVSS v3.1

EPSS:0.03%probability of exploitation in 30 daysPercentile:7.6th

Official Description

Vvveb before version 1.0.8.2 contains an information disclosure vulnerability that allows unauthenticated attackers to obtain sensitive server information by triggering unhandled exceptions in the password-reset module. Attackers can access the admin password-reset endpoint to trigger a fatal error caused by a missing namespace import, which exposes the absolute server file path, internal class namespaces, line numbers, and source code excerpts through the debug exception handler rendered to unauthenticated requests.

NVD Source

Technical Analysis

CVE-2026-41931 can be exploited remotely over the network without requiring physical or adjacent access, significantly expanding the attack surface for threat actors.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.