Runzero vulnerabilities

Products

• Platform 78
• Platform 12

Newest

• runzero platform runZero search SQL injection CVE-2026-110265 6.5 MediumNovember 3, 2026
• heliumedu platform Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe Internal Network CVE-2026-55875 4.3 MediumOctober 15, 2026
• heliumedu platform Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts CVE-2026-55876 3.5 LowOctober 15, 2026
• rapid7 platform Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup CVE-2026-97228 2.7 LowSeptember 25, 2026
• hcengineering platform Huly Platform through 0.7.426 SSRF via Print Service CVE-2026-91079 6.3 MediumSeptember 14, 2026
• runzero platform runZero MCP 'Findings summaries' Data Leak CVE-2026-81846 3.5 LowSeptember 1, 2026
• hcengineering platform Huly Platform - Server-Side Request Forgery via /import Endpoint CVE-2026-56769 6.3 MediumJune 25, 2026
• runzero platform, shopware +1 more Shopware: SSRF in Media External-Link Endpoint Bypasses IP Validation CVE-2026-48013 Fix available 4.1 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Stored XSS via SVG file upload — no SVG sanitization CVE-2026-48015 Fix available 4.9 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Unauthorized Payment Trigger for Foreign Orders via /store-api/handle-payment CVE-2026-48016 Fix available 4.3 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Admin API ACL Bypass in Order State Transition Endpoints CVE-2026-48014 Fix available 6.5 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware SSO referer trust leading to an arbitrary redirect target CVE-2026-48012 Fix available 4.3 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Privilege escalation: non-admin user with user:create ACL can create admin accounts CVE-2026-48010 Fix available 6.5 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Admin Account Takeover via User Recovery Hash Exposure CVE-2026-48009 Fix available 6.8 MediumJune 4, 2026
• runzero platform, shopware +1 more Shopware: Privilege Escalation via Sync API Integration Admin Flag Bypass CVE-2026-48008 Fix available 6.5 MediumJune 4, 2026
• runzero platform runZero Platform dashboard configuration exposure CVE-2026-7778 5.0 MediumMay 5, 2026
• runzero platform runZero Platform incorrect credential scope CVE-2026-5384 5.8 MediumApril 7, 2026
• runzero explorer, platform +1 more runZero Explorer missing authorization check CVE-2026-5383 4.4 MediumApril 7, 2026
• runzero platform runZero Platform MCP endpoint information leak CVE-2026-5382 3.0 LowApril 7, 2026
• runzero platform runZero Platform task information leak CVE-2026-5381 2.2 LowApril 7, 2026
• runzero platform runZero Platform cleartext secret exposure CVE-2026-5380 5.3 MediumApril 7, 2026
• runzero platform runZero Platform MCP certification information leak CVE-2026-5379 3.0 LowApril 7, 2026
• runzero platform runZero Platform user creation leak CVE-2026-5378 5.8 MediumApril 7, 2026
• runzero platform runZero Platform session timeout failure CVE-2026-5376 5.9 MediumApril 7, 2026
• runzero platform runZero Platform API credential information leak CVE-2026-5375 2.7 LowApril 7, 2026
• runzero platform runZero Platform MCP information leak CVE-2026-5374 5.8 MediumApril 7, 2026
• runzero platform runZero Platform superuser privilege escalation CVE-2026-5373 8.1 HighApril 7, 2026
• runzero platform runZero Platform SQL injection in saved queries CVE-2026-5372 6.4 MediumApril 7, 2026
• runzero platform, shopware, opnsense core +2 more Shopware has a potential take over of app credentials CVE-2026-31889 Fix available 8.9 HighMarch 11, 2026
• runzero platform, shopware, opnsense core +2 more Shopware has user enumeration via distinct error codes on Store API login endpoint CVE-2026-31888 Fix available 5.3 MediumMarch 11, 2026
• runzero platform, shopware, opnsense core +2 more Shopware unauthenticated data extraction possible through store-api.order endpoint CVE-2026-31887 Fix available 8.9 HighMarch 11, 2026
• lsfusion platform lsfusion platform ZipUtils.java unpackFile path traversal CVE-2025-13265 5.3 MediumNovember 17, 2025
• lsfusion platform lsfusion platform UploadFileRequestHandler.java UploadFileRequestHandler path traversal CVE-2025-13262 6.9 MediumNovember 17, 2025
• lsfusion platform lsfusion platform DownloadFileRequestHandler.java DownloadFileRequestHandler path traversal CVE-2025-13261 6.9 MediumNovember 17, 2025
• fuyang lipengjun platform fuyang_lipengjun platform queryAll SysSmsLogController improper authorization CVE-2025-10822 5.3 MediumSeptember 22, 2025
• fuyang lipengjun platform fuyang_lipengjun platform queryAll TopicCategoryController improper authorization CVE-2025-10821 5.3 MediumSeptember 22, 2025
• fuyang lipengjun platform fuyang_lipengjun platform queryAll TopicController improper authorization CVE-2025-10820 5.3 MediumSeptember 22, 2025
• fuyang lipengjun platform fuyang_lipengjun platform queryAll UserCouponController improper authorization CVE-2025-10819 5.3 MediumSeptember 22, 2025
• fuyang lipengjun platform fuyang_lipengjun platform queryAll BrandController improper authorization CVE-2025-10676 5.3 MediumSeptember 18, 2025
• fuyang lipengjun platform fuyang_lipengjun platform queryAll AttributeController improper authorization CVE-2025-10675 5.3 MediumSeptember 18, 2025
• fuyang lipengjun platform fuyang_lipengjun platform queryAll AttributeCategoryController improper authorization CVE-2025-10674 5.3 MediumSeptember 18, 2025
• fuyang lipengjun platform fuyang_lipengjun platform AdPositionController queryAll improper authorization CVE-2025-10086 5.3 MediumSeptember 8, 2025
• fuyang lipengjun platform fuyang_lipengjun platform queryAll AdController improper authorization CVE-2025-9936 5.3 MediumSeptember 3, 2025
• pagelines platform, platform theme +1 more Platform < 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Options Update CVE-2015-10143 Public exploit 9.8 CriticalJuly 25, 2025
• fuyang lipengjun platform fuyang_lipengjun platform ScheduleJobLogController.java queryPage sql injection CVE-2025-7936 5.3 MediumJuly 21, 2025
• fuyang lipengjun platform fuyang_lipengjun platform SysLogController.java SysLogController sql injection CVE-2025-7935 5.3 MediumJuly 21, 2025
• fuyang lipengjun platform fuyang_lipengjun platform ScheduleJobController.java queryPage sql injection CVE-2025-7934 5.3 MediumJuly 21, 2025
• orchidsoftware platform Method Exposure Vulnerability in Modals in orchid/platform CVE-2024-51992 Fix available 4.1 MediumNovember 11, 2024
• oroinc oroplatform, platform +1 more OroPlatform's pinned entity creation form shows pages of other users CVE-2023-45824 Fix available 4.3 MediumMarch 25, 2024
• oroinc oroplatform, platform +1 more OroPlatform vulnerable to path traversal during temporary file manipulations CVE-2022-41951 Fix available 8.6 HighNovember 27, 2023
• Show olderLoading…