Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- Medium6.1Formbricks before 4.9.0 contains an authorization bypass vulnerability in server actions like resetSurveyAction and updateSegmentAction that fail to verify resource ow…EPSS 0.6%Oct 14, 2026
- High7.1youlai-mall through commit 9f62de8 contains a missing authorization vulnerability that allows authenticated members to view every customer's orders via the app order list endpoint.EPSS 0.4%Oct 14, 2026
- Medium6.0REBUILD through 4.5.0 contains an authorization bypass vulnerability in AiBot2Controller /aibot2 endpoints that act on a caller-supplied chatid without verifying ownership.EPSS 0.3%Oct 14, 2026
- Medium5.3BizSpring Shop through commit cf22d39daaf1 contains an insecure direct object reference vulnerability in the OrderController cancel and receive handlers that allows au…EPSS 0.4%Oct 14, 2026
- High7.5The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up…EPSS 0.5%Oct 14, 2026
- Medium5.3The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.1.4 does not verify ownership of the email address used to select an abandoned-cart record befo…EPSS 0.2%Oct 14, 2026
- Medium5.3The Sifalo Pay WordPress plugin before 2.5.3 does not verify that a payment transaction identifier belongs to the order it is confirming, nor that the requester owns t…EPSS 0.2%Oct 14, 2026
- Medium4.3The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.14 does not verify that a user owns or may write to the album an upload is assigned to, a…EPSS 0.2%Oct 14, 2026
- Medium5.3Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability.EPSS 0.3%Oct 14, 2026
- Medium5.3Tronclass developed by WisdomGarden has a Insecure Direct Object Reference vulnerability.EPSS 0.3%Oct 14, 2026
- Low2.7The WP 2FA WordPress plugin before 4.2.0 does not perform an object-level capability check before removing a user's two-factor authentication configuration, allowing a…EPSS 0.3%Oct 14, 2026
- Medium4.3The GamiPress WordPress plugin before 8.0.6 does not perform a capability check or ownership verification on one of its authenticated AJAX actions, allowing any authen…EPSS 0.3%Oct 14, 2026
- Medium5.3The NEX-Forms WordPress plugin before 9.3.1 does not perform any authorization, ownership or request-validation checks before updating stored form entries, allowing un…EPSS 0.2%Oct 14, 2026
- Critical9.8Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' ParameterEPSS 0.4%Oct 13, 2026
- High8.7Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in the MobileFileDownload route that allows unauthenticated attackers to download…Oct 13, 2026
- High8.6Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability in setAffectations() that allows authenticated attackers to insert access-right r…EPSS 0.3%Oct 13, 2026
- High8.7Rapyd Admin from 9.0.0 before 9.20.0 contains an authorization bypass vulnerability that allows authenticated company members with the default customer role to modify…EPSS 0.5%Oct 13, 2026
- Medium5.3Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows authenticated users to read other users' generation resul…EPSS 0.3%Oct 13, 2026
- Medium5.3The Database Addon for Contact Form 7 – CFDB7 plugin for WordPress is vulnerable to Arbitrary File Deletion in versions up to, and including, 1.4.1.EPSS 0.3%Oct 13, 2026
- High7.1fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenti…EPSS 0.3%Oct 13, 2026
- Medium5.3Waynboot-mall through 2.0.0 contains an insecure direct object reference vulnerability that allows authenticated members to access and modify other members' orders by…EPSS 0.3%Oct 13, 2026
- High8.6FastBee through 2.1.0 contains an insecure direct object reference vulnerability in DeviceController that allows authenticated low-privilege users to read and modify o…EPSS 0.3%Oct 13, 2026
- Medium5.3Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the after-sales API that allows authenticated members to access other members' da…EPSS 0.2%Oct 13, 2026
- High7.1Yshopmall through 2.0.0 contains an insecure direct object reference vulnerability in the member address API that allows authenticated members to read, overwrite and d…EPSS 0.3%Oct 13, 2026
- Low2.3RuoYi-Cloud-Plus through 6.0.0 contains an insecure direct object reference vulnerability that allows authenticated users to delete other users' social login bindings…EPSS 0.3%Oct 13, 2026