The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that allows unauthenticated attackers to forge Strava webhook events without signature, verify-token or owner_id checks. Attackers can send forged delete events with a known public Strava activity id to the webhook URL, causing permanent deletion of imported activities and their streams.
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub