Llukevella

Products

Exploited and recent CVEs

• CVE-2026-92565 Medium 5.3 Rallly before 4.15.0 Information Disclosure via polls.get 0.5%
• CVE-2026-6493 Low 3.5 lukevella rallly Reset Password reset-password-form.tsx cross site scripting 0.3%
• CVE-2025-66027 High 7.1 Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings 0.4%
• CVE-2025-65034 High 8.1 Rallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId 0.4%
• CVE-2025-65033 High 8.1 Rallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation 0.4%
• CVE-2025-65032 Medium 6.5 Rallly Has an IDOR Vulnerability in Participant Rename Function Allows Unauthorized Modification of Other Users’ Names 0.3%
• CVE-2025-65031 Medium 6.5 Rallly Improper Authorization in Comment Endpoint Allows User Impersonation 0.3%
• CVE-2025-65030 High 7.1 Rallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removal 0.3%
• CVE-2025-65029 High 8.1 Rallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants 0.4%
• CVE-2025-65021 Critical 9.1 Rallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR) 0.4%
• CVE-2025-65020 Medium 6.5 Rallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR) 0.3%
• CVE-2025-65028 Medium 6.5 Rallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes 0.3%
• CVE-2025-47781 Critical 9.8 Rallly Insufficient Password Login Token Entropy Leads to Account Takeover 0.6%