Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
13 results
Sep 16, 2026Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addreCVE-2026-92565 · Other software · lukevella · reported by VulnCheckMedium 6.9
Rallly before 4.15.0 contains an information disclosure vulnerability in the polls.get tRPC procedure that returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can access a poll's urlId from public invite links to retrieve sensitive invitee information regardless of privacy settings.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 17, 2026A flaw has been found in lukevella rallly up to 4.7.4.CVE-2026-6493 · Other software · lukevella · reported by VulDBLow 2
A flaw has been found in lukevella rallly up to 4.7.4. This affects an unknown function of the file apps/web/src/app/[locale]/(auth)/reset-password/components/reset-password-form.tsx of the component Reset Password Handler. Executing a manipulation of the argument redirectTo can lead to cross site scripting. The attack can be executed remotely. The exploit has been published and may be used. Upgrading to version 4.8.0 mitigates this issue. Upgrading the affected component is advised. The vendor was contacted early about this disclosure.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgithub.com
Nov 28, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-66027 · Other software · lukevella · reported by GitHubHigh 7.1
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.6, an information disclosure vulnerability exposes participant details, including names and email addresses through the /api/trpc/polls.get,polls.participants.list endpoint, even when Pro privacy features are enabled. This bypasses intended privacy controls that should prevent participants from viewing other users’ personal information. This issue has been patched in version 4.5.6.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65034 · Other software · lukevella · reported by GitHubHigh 8.1
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization vulnerability allows any authenticated user to reopen finalized polls belonging to other users by manipulating the pollId parameter. This can disrupt events managed by other users and compromise both availability and integrity of poll data. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65033 · Other software · lukevella · reported by GitHubHigh 8.1
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the poll management feature allows any authenticated user to pause or resume any poll, regardless of ownership. The system only uses the public pollId to identify polls, and it does not verify whether the user performing the action is the poll owner. As a result, any user can disrupt polls created by others, leading to a loss of integrity and availability across the application. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65032 · Other software · lukevella · reported by GitHubMedium 6.5
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to change the display names of other participants in polls without being an admin or the poll owner. By manipulating the participantId parameter in a rename request, an attacker can modify another user’s name, violating data integrity and potentially causing confusion or impersonation attacks. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65031 · Other software · lukevella · reported by GitHubMedium 6.5
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an improper authorization flaw in the comment creation endpoint allows authenticated users to impersonate any other user by altering the authorName field in the API request. This enables attackers to post comments under arbitrary usernames, including privileged ones such as administrators, potentially misleading other users and enabling phishing or social engineering attacks. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65030 · Other software · lukevella · reported by GitHubHigh 7.1
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an authorization flaw in the comment deletion API allows any authenticated user to delete comments belonging to other users, including poll owners and administrators. The endpoint relies solely on the comment ID for deletion and does not validate whether the requesting user owns the comment or has permission to remove it. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65029 · Other software · lukevella · reported by GitHubHigh 8.1
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to delete arbitrary participants from polls without ownership verification. The endpoint relies solely on a participant ID to authorize deletions, enabling attackers to remove other users (including poll owners) from polls. This impacts the integrity and availability of poll participation data. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65028 · Other software · lukevella · reported by GitHubMedium 6.5
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an insecure direct object reference (IDOR) vulnerability allows any authenticated user to modify other participants’ votes in polls without authorization. The backend relies solely on the participantId parameter to identify which votes to update, without verifying ownership or poll permissions. This allows an attacker to alter poll results in their favor, directly compromising data integrity. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65021 · Other software · lukevella · reported by GitHubCritical 9.1
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability exists in the poll finalization feature of the application. Any authenticated user can finalize a poll they do not own by manipulating the pollId parameter in the request. This allows unauthorized users to finalize other users’ polls and convert them into events without proper authorization checks, potentially disrupting user workflows and causing data integrity and availability issues. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 19, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-65020 · Other software · lukevella · reported by GitHubMedium 6.5
Rallly is an open-source scheduling and collaboration tool. Prior to version 4.5.4, an Insecure Direct Object Reference (IDOR) vulnerability in the poll duplication endpoint (/api/trpc/polls.duplicate) allows any authenticated user to duplicate polls they do not own by modifying the pollId parameter. This effectively bypasses access control and lets unauthorized users clone private or administrative polls. This issue has been patched in version 4.5.4.
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 14, 2025Rallly is an open-source scheduling and collaboration tool.CVE-2025-47781 · Other software · lukevella · reported by GitHubCritical 9.8
Rallly is an open-source scheduling and collaboration tool. Versions up to and including 3.22.1 of the application features token based authentication. When a user attempts to login to the application, they insert their email and a 6 digit code is sent to their email address to complete the authentication. A token that consists of 6 digits only presents weak entropy however and when coupled with no token brute force protection, makes it possible for an unauthenticated attacker with knowledge of a valid email address to successfully brute force the token within 15 minutes (token expiration time) and take over the account associated with the targeted email address. All users on the Rallly applications are impacted. As long as an attacker knows the user's email address they used to register on the app, they can systematically take over any user account. For the authentication mechanism to be safe, the token would need to be assigned a complex high entropy value that cannot be bruteforced within reasonable time, and ideally rate limiting the /api/auth/callback/email endpoint to further make brute force attempts unreasonable within the 15 minutes time. As of time of publication, no patc
- Product
- rallly
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.