rallly records
11 published records for vendor rallly.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 90.9%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-285 Improper Authorization7
- CWE-639 Authorization Bypass Through User-Controlled Key2
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor1
- CWE-331 Insufficient Entropy1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
11 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
39Monitor | CVE-2025-47781No exploit | Rallly Insufficient Password Login Token Entropy Leads to Account Takeoverrallly · rallly · CWE-331 | Critical9.8 | — | 0.6% | May 14, 2025 |
36Monitor | CVE-2025-65021No exploit | Rallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR)rallly · rallly · CWE-285 | Critical9.1 | — | 0.4% | Nov 19, 2025 |
32Monitor | CVE-2025-65033No exploit | Rallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulationrallly · rallly · CWE-285 | High8.1 | — | 0.3% | Nov 19, 2025 |
32Monitor | CVE-2025-65034No exploit | Rallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollIdrallly · rallly · CWE-639 | High8.1 | — | 0.3% | Nov 19, 2025 |
32Monitor | CVE-2025-65029No exploit | Rallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participantsrallly · rallly · CWE-285 | High8.1 | — | 0.3% | Nov 19, 2025 |
28Monitor | CVE-2025-66027No exploit | Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settingsrallly · rallly · CWE-200 | High7.1 | — | 0.3% | Nov 29, 2025 |
28Monitor | CVE-2025-65030No exploit | Rallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removalrallly · rallly · CWE-285 | High7.1 | — | 0.3% | Nov 19, 2025 |
26Monitor | CVE-2025-65032No exploit | Rallly Has an IDOR Vulnerability in Participant Rename Function Allows Unauthorized Modification of Other Users’ Namesrallly · rallly · CWE-639 | Medium6.5 | — | 0.2% | Nov 19, 2025 |
26Monitor | CVE-2025-65028No exploit | Rallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votesrallly · rallly · CWE-285 | Medium6.5 | — | 0.2% | Nov 19, 2025 |
26Monitor | CVE-2025-65031No exploit | Rallly Improper Authorization in Comment Endpoint Allows User Impersonationrallly · rallly · CWE-285 | Medium6.5 | — | 0.2% | Nov 19, 2025 |
26Monitor | CVE-2025-65020No exploit | Rallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR)rallly · rallly · CWE-285 | Medium6.5 | — | 0.2% | Nov 19, 2025 |
- CVE-2025-4778139Monitor
Rallly Insufficient Password Login Token Entropy Leads to Account Takeover
CriticalCVSS 9.8No exploitEPSS 0%rallly · ralllyMay 14, 2025
- CVE-2025-6502136Monitor
Rallly Has Unauthorized Poll Finalization via Insecure Direct Object Reference (IDOR)
CriticalCVSS 9.1No exploitEPSS 0%rallly · ralllyNov 19, 2025
- CVE-2025-6503332Monitor
Rallly Broken Authorization: Any User Can Pause or Resume Any Poll via Poll ID Manipulation
HighCVSS 8.1No exploitEPSS 0%rallly · ralllyNov 19, 2025
- CVE-2025-6503432Monitor
Rallly Improper Authorization Allows Reopening of Any Finalized Poll via Public pollId
HighCVSS 8.1No exploitEPSS 0%rallly · ralllyNov 19, 2025
- CVE-2025-6502932Monitor
Rallly Has an IDOR Vulnerability in Participant Deletion Endpoint Allows Unauthorized Removal of Poll Participants
HighCVSS 8.1No exploitEPSS 0%rallly · ralllyNov 19, 2025
- CVE-2025-6602728Monitor
Rallly Information Disclosure Vulnerability in Participant API Leaks Names and Emails Despite Pro Privacy Settings
HighCVSS 7.1No exploitEPSS 0%rallly · ralllyNov 29, 2025
- CVE-2025-6503028Monitor
Rallly Improper Authorization in Comment Deletion Endpoint Allows Unauthorized Comment Removal
HighCVSS 7.1No exploitEPSS 0%rallly · ralllyNov 19, 2025
- CVE-2025-6503226Monitor
Rallly Has an IDOR Vulnerability in Participant Rename Function Allows Unauthorized Modification of Other Users’ Names
MediumCVSS 6.5No exploitEPSS 0%rallly · ralllyNov 19, 2025
- CVE-2025-6502826Monitor
Rallly Has an IDOR Vulnerability in Vote Update Endpoint Allows Unauthorized Manipulation of Participant Votes
MediumCVSS 6.5No exploitEPSS 0%rallly · ralllyNov 19, 2025
- CVE-2025-6503126Monitor
Rallly Improper Authorization in Comment Endpoint Allows User Impersonation
MediumCVSS 6.5No exploitEPSS 0%rallly · ralllyNov 19, 2025
- CVE-2025-6502026Monitor
Rallly Has Unauthorized Poll Duplication via Insecure Direct Object Reference (IDOR)
MediumCVSS 6.5No exploitEPSS 0%rallly · ralllyNov 19, 2025