Vulnerabilities published by Secur0
Explore the list of CVEs reported through Secur0's programs. Check technical details and vulnerability statuses.
CVE-2026-95832
Reflected unknown field names in the kitty colour control escape code allow command execution in the user's shell
Critical
CVE-2026-78365
IDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification
Critical
CVE-2026-19871
Use of hard-coded credentials in Prospero Flow CRM allows access to employee accounts created through the onboarding flow
Critical
CVE-2026-114519
Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts
High
CVE-2026-115453
Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries
High
CVE-2026-115450
Price manipulation in the Ecommerce Template checkout flow through a client supplied Stripe price identifier
High
CVE-2026-104025
Path traversal in PeaZip object preview allows execution of arbitrary programs via a crafted archive entry name
High
cve-2026-100169
Account pre-hijacking in the Prowler API through email based social account linking without verification
High
CVE-2026-102514
Out-of-bounds write in PeaZip PEA extractor allows code execution via a crafted .pea archive
High
CVE-2026-90896
Missing authentication in Ecommerce Template checkout session endpoint allows unauthenticated disclosure of buyer PII
High
CVE-2026-77759
IDOR and missing authorization in the Prospero Flow CRM transaction API allow cross-tenant reading of financial records
High
CVE-2026-19870
IDOR in Prospero Flow CRM allows cross-tenant payroll disclosure and creation
High
CVE-2026-19734
IDOR in Prospero Flow CRM allows cross-tenant product disclosure and hijacking
High
CVE-2026-19539
IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion
High
CVE-2026-19433
Authorization Bypass Through User-Controlled Key in Prospero Flow CRM allows writing and reading other companies' contacts
High
CVE-2026-59233
Missing Authorization in Prospero Flow CRM allows any authenticated user to escalate privileges via the permission save endpoint
High
CVE-2026-59239
Stored XSS in Prospero Flow CRM email body allows administrator account takeover
High
CVE-2026-59235
Missing authorization in Prospero Flow CRM allows low-privileged users to read all bank accounts
High
CVE-2026-13164
Unauthenticated self-registration in MailerUp allows access to stored email data
High
CVE-2026-121577
Unescaped header separators in whatstk build a regular expression that backtracks exponentially
Medium
CVE-2026-104024
Incomplete dangerous-extension list in PeaZip object open allows execution of a program or command from a crafted archive entry without confirmation
Medium
CVE-2026-91154
Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service
Medium
cve-2026-95835
Missing ownership check on the shared memory object named by the kitty askpass escape code
Medium
cve-2026-95834
Use after free in the kitty drag and drop protocol when a drag source item is aborted mid-transfer
Medium
CVE-2026-80432
Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a drop
Medium
CVE-2026-80431
Out-of-bounds write in the kitty text sizing protocol allows termination of the terminal process
Medium
CVE-2026-80430
Improper link resolution in the kitty drag and drop protocol allows a client to create files outside the staging directory
Medium
CVE-2026-82911
CSRF in Prospero Flow CRM order confirmation allows unauthorized order state changes
Medium
CVE-2026-81931
Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting
Medium
CVE-2026-78337
Unrestricted upload of file with dangerous type in Prospero Flow CRM allows stored cross-site scripting via SVG
Medium
CVE-2026-77780
Unvalidated bank account and card foreign keys in the Prospero Flow CRM transaction save endpoint allow cross-tenant disclosure of banking identifiers
Medium
CVE-2026-76203
CSS sanitizer bypass in Pentestify report themes allows forced outbound requests from users' browsers
Medium
CVE-2026-75872
HTML Injection in MailerUp allows attacker-controlled HTML to be delivered in double opt-in verification emails
Medium
CVE-2026-19744
Stored Cross-site Scripting in Pentestify allows JavaScript execution via Markdown links in report fields
Medium
CVE-2026-19716
Stored Cross-site Scripting in Pentestify user account deletion via unescaped username
Medium
CVE-2026-19434
Stored Cross-site Scripting in Pentestify allows JavaScript execution via the finding severity field
Medium
CVE-2026-59232
Stored Cross-site Scripting in Prospero Flow CRM allows JavaScript execution via the lead form name field
Medium
CVE-2026-59231
Server-Side Request Forgery in Pentestify allows authenticated users to trigger outbound server requests via unvalidated image URLs
Medium
CVE-2026-59240
IDOR in Prospero Flow CRM allows deletion of other users notifications
Medium
CVE-2026-59238
Stored XSS in Pentestify via unsanitized finding images and report client logo
Medium
CVE-2026-59237
IDOR in Prospero Flow CRM Order API allows cross-tenant read and modification of orders
Medium
CVE-2026-59236
Authorization bypass in Prospero Flow CRM Excel import allows cross-tenant record injection
Medium
CVE-2026-59234
IDOR in Prospero Flow CRM allows deletion of other users' calendar events
Medium
CVE-2026-13163
Lack of input validation in Mailerup input parameter leads to Open Redirect
Medium
CVE-2026-13150
SSRF in Pentestify PDF generation endpoint via crafted Host header
Medium
CVE-2026-121564
Silent loss of messages when merging overlapping chat exports in whatstk
Low
Found a vulnerability? Learn more in our Disclosure policy