onlook records

3 published records for vendor onlook.

Researcher profile

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

3 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
30Monitor	CVE-2025-63783No exploit	A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) oonlook · onlook · CWE-20	High7.6	—	0.3%	Nov 7, 2025
26Monitor	CVE-2025-63784No exploit	An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook onlook · onlook · CWE-601 Open redirect Denial of service	Medium6.5	—	0.4%	Nov 7, 2025
24Monitor	CVE-2025-63785No exploit	A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32.onlook · onlook · CWE-20 Pre-auth XSS	Medium6.1	—	0.2%	Nov 7, 2025

CVE-2025-63783
30Monitor
A Broken Object Level Authorization (BOLA) vulnerability was discovered in the tRPC project mutation APIs (update, delete, add/remove tag) o
HighCVSS 7.6No exploitEPSS 0%
onlook · onlookNov 7, 2025
CVE-2025-63784
26Monitor
An Open Redirect vulnerability exists in the OAuth callback handler in file onlook/apps/web/client/src/app/auth/callback/route.ts in Onlook
MediumCVSS 6.5No exploitEPSS 0%
- Open redirect
- Denial of service
onlook · onlookNov 7, 2025
CVE-2025-63785
24Monitor
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the text editor feature of the Onlook web application 0.2.32.
MediumCVSS 6.1No exploitEPSS 0%
- Pre-auth
- XSS
onlook · onlookNov 7, 2025