# Givanz vulnerabilities Source: https://junglewise.ai/threats/vendors/givanz Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/givanz.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 14 vulnerabilities in Givanz: 0 in the last 7 days and 1 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-112905, was published on 30 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. 1 critical against 0. 2 technologies have a page of their own. ## Counts - Last 7 days: 0 - Last 30 days: 1 - Last 90 days: 1 - All time: 14 (2 critical, 0 exploited in the wild) ## About Givanz The developer of the Vantajs library and other web-based visual tools. ## Latest Givanz vulnerabilities - [CVE-2026-112905: Vvveb CMS insecure direct object reference in API token management](https://junglewise.ai/threats/cve-2026-112905-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to) (critical, CVSS 9, published 30 Oct 2026) - [CVE-2026-46408: Vvveb CMS authorization bypass in checkout endpoint](https://junglewise.ai/threats/cve-2026-46408-vvveb-cms-authorization-bypass-in-checkout-endpoint) (high, CVSS 7.6, published 15 May 2026) - [CVE-2026-45800: Givanz Vvveb CMS SQL injection in order history page](https://junglewise.ai/threats/cve-2026-45800-givanz-vvveb-cms-sql-injection-in-order-history-page) (info, CVSS 8.7, published 15 May 2026) - [CVE-2026-45622: Vvveb CMS reflected XSS in product return form](https://junglewise.ai/threats/cve-2026-45622-vvveb-cms-reflected-xss-in-product-return-form) (info, CVSS 5.3, published 15 May 2026) - [CVE-2026-44826: Vvveb CMS negative quantity input validation in cart-add endpoint](https://junglewise.ai/threats/cve-2026-44826-vvveb-cms-negative-quantity-input-validation-in-cart-add-endpoint) (high, CVSS 7.5, published 15 May 2026) - [CVE-2026-44366: Givanz Vvveb CMS Stored XSS in comment author field](https://junglewise.ai/threats/cve-2026-44366-givanz-vvveb-cms-stored-xss-in-comment-author-field) (medium, CVSS 6.1, published 15 May 2026) - [CVE-2026-41937: Givanz Vvveb unrestricted file upload in plugin upload endpoint](https://junglewise.ai/threats/cve-2026-41937-givanz-vvveb-unrestricted-file-upload-in-plugin-upload-endpoint) (high, CVSS 7.2, published 14 May 2026) - [CVE-2026-41935: Vvveb uncontrolled recursion in admin controller dispatch cycle](https://junglewise.ai/threats/cve-2026-41935-vvveb-uncontrolled-recursion-in-admin-controller-dispatch-cycle) (high, CVSS 7.1, published 14 May 2026) - [CVE-2026-41929: Givanz Vvveb CMS reflected XSS in visual editor preview renderer](https://junglewise.ai/threats/cve-2026-41929-givanz-vvveb-cms-reflected-xss-in-visual-editor-preview-renderer) (medium, CVSS 6.1, published 7 May 2026) - [CVE-2026-41928: Vvveb information disclosure in cron controller](https://junglewise.ai/threats/cve-2026-41928-vvveb-information-disclosure-in-cron-controller) (medium, CVSS 5.3, published 7 May 2026) - [CVE-2026-39918: Vvveb code injection in installation endpoint](https://junglewise.ai/threats/cve-2026-39918-vvveb-code-injection-in-installation-endpoint) (critical, CVSS 9.8, published 20 Apr 2026) - [CVE-2026-34429: Givanz Vvveb stored XSS via media upload and rename bypass](https://junglewise.ai/threats/cve-2026-34429-givanz-vvveb-stored-xss-via-media-upload-and-rename-bypass) (medium, CVSS 5.4, published 20 Apr 2026) - [CVE-2026-34427: Givanz Vvveb privilege escalation in admin user profile save endpoint](https://junglewise.ai/threats/cve-2026-34427-givanz-vvveb-privilege-escalation-in-admin-user-profile-save) (high, CVSS 8.8, published 20 Apr 2026) - [CVE-2026-5615: givanz Vvvebjs cross-site scripting in upload.php](https://junglewise.ai/threats/cve-2026-5615-givanz-vvvebjs-cross-site-scripting-in-upload-php) (medium, CVSS 4.3, published 6 Apr 2026) ## Most severe Givanz vulnerabilities - [CVE-2026-39918: Vvveb code injection in installation endpoint](https://junglewise.ai/threats/cve-2026-39918-vvveb-code-injection-in-installation-endpoint) (critical, CVSS 9.8, published 20 Apr 2026) - [CVE-2026-112905: Vvveb CMS insecure direct object reference in API token management](https://junglewise.ai/threats/cve-2026-112905-vvveb-is-a-powerful-and-easy-to-use-cms-with-page-builder-to) (critical, CVSS 9, published 30 Oct 2026) - [CVE-2026-34427: Givanz Vvveb privilege escalation in admin user profile save endpoint](https://junglewise.ai/threats/cve-2026-34427-givanz-vvveb-privilege-escalation-in-admin-user-profile-save) (high, CVSS 8.8, published 20 Apr 2026) - [CVE-2026-46408: Vvveb CMS authorization bypass in checkout endpoint](https://junglewise.ai/threats/cve-2026-46408-vvveb-cms-authorization-bypass-in-checkout-endpoint) (high, CVSS 7.6, published 15 May 2026) - [CVE-2026-44826: Vvveb CMS negative quantity input validation in cart-add endpoint](https://junglewise.ai/threats/cve-2026-44826-vvveb-cms-negative-quantity-input-validation-in-cart-add-endpoint) (high, CVSS 7.5, published 15 May 2026) - [CVE-2026-41937: Givanz Vvveb unrestricted file upload in plugin upload endpoint](https://junglewise.ai/threats/cve-2026-41937-givanz-vvveb-unrestricted-file-upload-in-plugin-upload-endpoint) (high, CVSS 7.2, published 14 May 2026) - [CVE-2026-41935: Vvveb uncontrolled recursion in admin controller dispatch cycle](https://junglewise.ai/threats/cve-2026-41935-vvveb-uncontrolled-recursion-in-admin-controller-dispatch-cycle) (high, CVSS 7.1, published 14 May 2026) - [CVE-2026-41929: Givanz Vvveb CMS reflected XSS in visual editor preview renderer](https://junglewise.ai/threats/cve-2026-41929-givanz-vvveb-cms-reflected-xss-in-visual-editor-preview-renderer) (medium, CVSS 6.1, published 7 May 2026) - [CVE-2026-44366: Givanz Vvveb CMS Stored XSS in comment author field](https://junglewise.ai/threats/cve-2026-44366-givanz-vvveb-cms-stored-xss-in-comment-author-field) (medium, CVSS 6.1, published 15 May 2026) - [CVE-2026-34429: Givanz Vvveb stored XSS via media upload and rename bypass](https://junglewise.ai/threats/cve-2026-34429-givanz-vvveb-stored-xss-via-media-upload-and-rename-bypass) (medium, CVSS 5.4, published 20 Apr 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. 1 critical against 0. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 1 | 1 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Givanz technologies - [Givanz Vvvebjs](https://junglewise.ai/threats/technologies/vvvebjs): 9 vulnerabilities - [Givanz Vvveb CMS](https://junglewise.ai/threats/technologies/vvveb-cms): 6 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Givanz vulnerabilities", https://junglewise.ai/threats/vendors/givanz, 9 November 2026.