App vulnerabilities
CVEs whose affected-version data names the App package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-76124High· 8.8BuddyBoss App <= 3.2.1 - Authenticated (Subscriber+) Arbitrary File Upload via Feedback Endpoint
The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-s…
CVE-2026-5698Medium· 4.8Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters an…
CVE-2026-5697Medium· 4.8Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters an…
CVE-2026-5702Medium· 4.8Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application
Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an authenticated user into clicking a malicious link or loading a page that sends unauthorized requests to a vulnerable endpoint.
CVE-2026-5699Medium· 4.8Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters an…
CVE-2026-5700Medium· 4.8Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application
Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript code so that when a user views the page, code can be executed in the victim's browser. The list of assigned parameters an…
CVE-2026-115904Critical· 9.6PoCTopluyo Desktop for Linux has an OS Command Injection issue
Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the `openExternalLinks()` ro…