CVEs published by Secur0

CVEs published by Secur0 (CVE Numbering Authority). 16 tracked.

• CVE-2026-59239 HIGH 8.6 Stored Cross-site Scripting (CWE-79) in the email module in Roskus Prospero Flow CRM before 5.4.4 allows a rem
• CVE-2026-59240 MEDIUM 6.9 The vulnerability involves an Insecure Direct Object Reference (IDOR) in the `DeleteNotificationController::de
• CVE-2026-13163 MEDIUM 5.3 Open redirect vulnerability (CWE-601) in the _safe_redirect function of the click-tracking endpoint (/c/<token
• CVE-2026-13164 HIGH 8.8 Missing Authentication for Critical Function (CWE-306) in the RegisterView (apps/accounts/views.py), exposed a
• CVE-2026-59232 MEDIUM 5.3 Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated user
• CVE-2026-59231 MEDIUM 5.3 Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticate
• CVE-2026-59233 HIGH 8.7 Missing Authorization in the permission management component in Roskus Prospero Flow CRM before 5.2.1 allows a
• CVE-2026-19433 HIGH 8.6 Authorization Bypass Through User-Controlled Key in the contact management component in Roskus Prospero Flow C
• CVE-2026-114519 HIGH 8.6 Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a
• CVE-2026-19539 HIGH 8.6 Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CR
• CVE-2026-19434 MEDIUM 5.1 Cross-site Scripting in the finding renderer in maalfer Pentestify before 2.3.1 allows authenticated users to
• CVE-2026-19734 HIGH 8.6 Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component
• CVE-2026-19716 MEDIUM 5.1 Stored Cross-site Scripting (CWE-79) in the user management component in maalfer Pentestify before 1.1.1 allow
• CVE-2026-75872 MEDIUM 6.9 HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote
• CVE-2026-115453 HIGH 7.1 Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCama
• CVE-2026-115450 HIGH 7.1 External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01

← Back to latest CVEs