https://vulnogram.org/ Most recent CVEs assigned by Secur0 (secur0). https://vulnogram.org/seaview/icons/secur0.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-104024 https://vulnogram.org/CVE-2026-104024 Incomplete List of Disallowed Inputs (CWE-184) in the dangerous-extension confirmation of the archive object viewer (peach.pas, grid_obj_open) in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a… Medium Thu, 15 Oct 2026 13:30:13 GMT https://vulnogram.org/CVE-2026-104025 https://vulnogram.org/CVE-2026-104025 Path Traversal (CWE-22) in the execute_obj function of the archive object viewer (peach.pas) in PeaZip 11.2.0 and earlier on Windows allows an attacker who convinces a victim to preview an entry of a crafted archive via the "Preview with... -> Associ… High Thu, 15 Oct 2026 12:00:49 GMT https://vulnogram.org/CVE-2026-100169 https://vulnogram.org/CVE-2026-100169 Improper Authentication in the social account linking path of the Prowler API in Prowler from 5.4.0 before 5.35.0 allows a remote unauthenticated attacker to obtain persistent access to the account of a user who has not yet registered, because Prowle… High Network Exploitable Wed, 14 Oct 2026 16:01:59 GMT https://vulnogram.org/CVE-2026-102514 https://vulnogram.org/CVE-2026-102514 Out-of-bounds Write (CWE-787) in the PEA archive extraction routine (pea.pas, unpea_procedure) of the first-party pea component in PeaZip 11.2.0 and earlier allows an attacker who convinces a victim to open or extract a crafted .pea archive to execut… High Thu, 01 Oct 2026 20:00:51 GMT https://vulnogram.org/CVE-2026-91154 https://vulnogram.org/CVE-2026-91154 Missing Authentication for Critical Function (CWE-306) in the product cache revalidation Server Action (src/app/actions.ts, revalidateProducts) in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to fo… Medium Network Exploitable Mon, 28 Sep 2026 15:29:03 GMT https://vulnogram.org/CVE-2026-95835 https://vulnogram.org/CVE-2026-95835 Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handle_remote_askpass()… Medium Fri, 25 Sep 2026 16:33:30 GMT https://vulnogram.org/CVE-2026-95834 https://vulnogram.org/CVE-2026-95834 Use After Free in the drag source path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to cause the terminal to read from and write to freed heap memory, because drag_remote_file_data() in kit… Medium Fri, 25 Sep 2026 16:28:09 GMT https://vulnogram.org/CVE-2026-80432 https://vulnogram.org/CVE-2026-80432 Missing Authorization in the drop handling path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to obtain the contents of files dragged over the window even when the user never completes the d… Medium Fri, 25 Sep 2026 16:22:09 GMT https://vulnogram.org/CVE-2026-80431 https://vulnogram.org/CVE-2026-80431 Out-of-bounds Write in the natural width branch of the text sizing protocol in kitty from 0.40.0 before 0.49.0 allows a program writing to the terminal to write past the end of a fixed-size buffer, because screen_handle_multicell_command() in kitty/s… Medium Fri, 25 Sep 2026 13:23:51 GMT https://vulnogram.org/CVE-2026-80430 https://vulnogram.org/CVE-2026-80430 Improper Link Resolution Before File Access in the drag source staging path of the drag and drop protocol in kitty from 0.47.0 before 0.49.0 allows a program writing to the terminal to create files and directories at paths outside the staging directo… Medium Fri, 25 Sep 2026 13:08:13 GMT https://vulnogram.org/CVE-2026-95832 https://vulnogram.org/CVE-2026-95832 Improper Neutralization of Special Elements in Output Used by a Downstream Component in the colour control escape code handler in kitty from 0.47.3 before 0.49.0 allows a program writing to the terminal to execute an arbitrary command in the user's s… Critical Fri, 25 Sep 2026 12:54:25 GMT https://vulnogram.org/CVE-2026-90896 https://vulnogram.org/CVE-2026-90896 Missing Authentication for Critical Function (CWE-306) in the checkout session lookup handler (src/app/api/stripe/checkout_sessions/route.ts), exposed at GET /api/stripe/checkout_sessions, in MarcosCamara01 Ecommerce Template before commit 91e273c al… High Network Exploitable Mon, 14 Sep 2026 20:58:39 GMT https://vulnogram.org/CVE-2026-82911 https://vulnogram.org/CVE-2026-82911 Cross-Site Request Forgery (CSRF) in the OrderConfirmController at GET /order/confirm/{order_number} in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing th… Medium Network Exploitable Fri, 04 Sep 2026 15:33:44 GMT https://vulnogram.org/CVE-2026-81931 https://vulnogram.org/CVE-2026-81931 Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission (routine Seller role) to execute arbitrary JavaScript in the appl… Medium Thu, 27 Aug 2026 19:33:27 GMT https://vulnogram.org/CVE-2026-78365 https://vulnogram.org/CVE-2026-78365 Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own company, via a PU… Critical Network Exploitable Mon, 24 Aug 2026 12:49:36 GMT https://vulnogram.org/CVE-2026-78337 https://vulnogram.org/CVE-2026-78337 Unrestricted Upload of File with Dangerous Type in the company logo upload in Roskus Prospero Flow CRM before 5.15.13 allows an authenticated user holding the create company and update company permissions to execute arbitrary JavaScript in the applic… Medium Mon, 24 Aug 2026 11:01:30 GMT https://vulnogram.org/CVE-2026-77780 https://vulnogram.org/CVE-2026-77780 Authorization Bypass Through User-Controlled Key in the transaction save endpoint in Roskus Prospero Flow CRM 4.9.1 through 5.14.0 allows a user with transaction and accounting creation permissions to disclose another company's bank account name, ban… Medium Fri, 21 Aug 2026 12:12:59 GMT https://vulnogram.org/CVE-2026-77759 https://vulnogram.org/CVE-2026-77759 Authorization Bypass Through User-Controlled Key in the transaction API in Roskus Prospero Flow CRM 5.0.0 through 5.3.5 allows an authenticated user to read the transactions of other companies on the same instance via an incremented identifier in GET… High Network Exploitable Fri, 21 Aug 2026 11:29:43 GMT https://vulnogram.org/CVE-2026-76203 https://vulnogram.org/CVE-2026-76203 Incorrect Behavior Order: Validate Before Canonicalize in the report theme CSS sanitizer in maalfer Pentestify 1.2.0 through 2.3.2 allows an authenticated user to force outbound HTTP requests from other users' browsers, disclosing their IP address an… Medium Wed, 19 Aug 2026 14:23:17 GMT https://vulnogram.org/CVE-2026-75872 https://vulnogram.org/CVE-2026-75872 HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen address and from the form owner's configured… Medium Network Exploitable Tue, 18 Aug 2026 14:06:37 GMT https://vulnogram.org/CVE-2026-19871 https://vulnogram.org/CVE-2026-19871 Use of Hard-coded Credentials in the human resources component in Roskus Prospero Flow CRM before 5.15.9 allows unauthenticated remote attackers to authenticate as any employee onboarded through the standard flow, knowing only their email address, be… Critical Network Exploitable Fri, 14 Aug 2026 14:00:55 GMT https://vulnogram.org/CVE-2026-19870 https://vulnogram.org/CVE-2026-19870 Authorization Bypass Through User-Controlled Key in the payroll module in Roskus Prospero Flow CRM before 5.15.10 allows authenticated users holding the read payroll permission to view the salary and banking details of employees of any other company… High Fri, 14 Aug 2026 12:08:30 GMT https://vulnogram.org/CVE-2026-19744 https://vulnogram.org/CVE-2026-19744 Cross-site Scripting in the Markdown renderer in maalfer Pentestify before 2.3.2 allows authenticated users to execute arbitrary JavaScript in the application origin via a Markdown link whose URL contains a double quote, which closes the anchor's hre… Medium Thu, 13 Aug 2026 15:41:00 GMT https://vulnogram.org/CVE-2026-19734 https://vulnogram.org/CVE-2026-19734 Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU… High Thu, 13 Aug 2026 14:04:55 GMT https://vulnogram.org/CVE-2026-19716 https://vulnogram.org/CVE-2026-19716 Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allows an authenticated attacker to execute arbitrary JavaScript in the browser of another authenticated user via a crafted username, because the… Medium Thu, 13 Aug 2026 13:28:17 GMT https://vulnogram.org/CVE-2026-19539 https://vulnogram.org/CVE-2026-19539 Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content (title, description, and attachments) of tickets belonging… High Tue, 11 Aug 2026 13:54:05 GMT https://vulnogram.org/CVE-2026-19434 https://vulnogram.org/CVE-2026-19434 Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to execute arbitrary JavaScript in the application origin via HTML markup stored in a finding's severity field, which the frontend interpolates… Medium Tue, 11 Aug 2026 13:40:59 GMT https://vulnogram.org/CVE-2026-19433 https://vulnogram.org/CVE-2026-19433 Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow CRM before 5.4.8 allows authenticated users of any company to blindly overwrite the contact data of another company and to download that cont… High Mon, 10 Aug 2026 14:04:14 GMT https://vulnogram.org/CVE-2026-59233 https://vulnogram.org/CVE-2026-59233 Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows any authenticated user to grant any role, including their own, the complete set of application permissions via a crafted POST request to the… High Mon, 10 Aug 2026 12:14:40 GMT https://vulnogram.org/CVE-2026-59232 https://vulnogram.org/CVE-2026-59232 Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead… Medium Network Exploitable Fri, 31 Jul 2026 16:00:45 GMT https://vulnogram.org/CVE-2026-59231 https://vulnogram.org/CVE-2026-59231 Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the fin… Medium Fri, 31 Jul 2026 15:06:05 GMT https://vulnogram.org/CVE-2026-59240 https://vulnogram.org/CVE-2026-59240 The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::delete()` method at endpoint `GET /notification/delete/{id}`. The flaw allows any authenticated user, regardless of company or permissions, to… Medium Network Exploitable Mon, 27 Jul 2026 21:37:33 GMT https://vulnogram.org/CVE-2026-59239 https://vulnogram.org/CVE-2026-59239 Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a remote, authenticated low-privileged user to execute arbitrary JavaScript in another user's browser, including administrators, leading to sessi… High Network Exploitable Mon, 27 Jul 2026 17:56:08 GMT https://vulnogram.org/CVE-2026-59238 https://vulnogram.org/CVE-2026-59238 Stored Cross-site Scripting (CWE-79) in the client-side report rendering functions (renderPreview, renderEditor, renderAuditData in js/app.js) in maalfer Pentestify before 1.1.0 allows a remote, authenticated attacker to execute arbitrary JavaScript… Medium Network Exploitable Mon, 20 Jul 2026 13:58:01 GMT https://vulnogram.org/CVE-2026-59237 https://vulnogram.org/CVE-2026-59237 Authorization Bypass Through User-Controlled Key (CWE-639) in the Order and OrderItem REST API controllers in Roskus Prospero Flow CRM before 5.5.3 allows a remote, authenticated user to read, modify, and delete orders and order items belonging to an… Medium Network Exploitable Thu, 16 Jul 2026 14:35:46 GMT https://vulnogram.org/CVE-2026-59236 https://vulnogram.org/CVE-2026-59236 Authorization Bypass Through User-Controlled Key (CWE-639) in the Excel import handlers (CustomerImport, LeadImport, ProductImport) in Roskus Prospero Flow CRM before 5.14.0 allows a remote, authenticated user of any role or company to create custome… Medium Network Exploitable Wed, 15 Jul 2026 11:09:38 GMT https://vulnogram.org/CVE-2026-59235 https://vulnogram.org/CVE-2026-59235 Missing Authorization (CWE-862) in BankAccountListController (app/Http/Controllers/Api/BankAccount/BankAccountListController.php), exposed at GET /api/bank-account, in Prospero Flow CRM <5.5.3, which allows a remote, authenticated attacker holding a… High Network Exploitable Wed, 15 Jul 2026 10:38:20 GMT https://vulnogram.org/CVE-2026-59234 https://vulnogram.org/CVE-2026-59234 Authorization Bypass Through User-Controlled Key (CWE-639) in CalendarDeleteEventController (app/Http/Controllers/Calendar/CalendarDeleteEventController.php), exposed at GET /calendar/event/delete/{id}, in Prospero Flow CRM before 5.5.3 allows a remo… Medium Network Exploitable Fri, 03 Jul 2026 12:47:38 GMT https://vulnogram.org/CVE-2026-13164 https://vulnogram.org/CVE-2026-13164 Missing Authentication for Critical Function (CWE-306) in the RegisterView (apps/accounts/views.py), exposed at POST /api/auth/register/, in MailerUp <1.0.1 allows a remote, unauthenticated attacker to self-register a working account on instances whe… High Network Exploitable Wed, 24 Jun 2026 15:37:17 GMT https://vulnogram.org/CVE-2026-13163 https://vulnogram.org/CVE-2026-13163 Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking endpoint (/c/<token>/) in Mailerup <1.0.0 on all platforms allows remote unauthenticated attackers to redirect victims to arbitrary external sites and conduct… Medium Network Exploitable Wed, 24 Jun 2026 12:49:05 GMT https://vulnogram.org/CVE-2026-13150 https://vulnogram.org/CVE-2026-13150 Server-Side Request Forgery (SSRF) (CWE-918) in the PDF generation endpoint GET /api/reports/{id}/pdf (backend/main.py) in ccyl13 Pentestify 1.0.0 and lower allows remote attackers to make the server issue requests to arbitrary internal or external U… Medium Network Exploitable Wed, 24 Jun 2026 10:45:17 GMT