PL
Product
Placipy
10
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 7High 2Medium 1Low 0
Watch
Add Placipy to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-25875 | 9.8 | Feb 9 | PlaciPy Admin Privilege Escalation via Trusted JWT Claims Affected: 1.0.0 |
| CVE-2026-25814 | 9.8 | Feb 9 | NoSQL Injection Risk via Unsanitized Query Parameters Affected: 1.0.0 |
| CVE-2026-25809 | 9.8 | Feb 9 | PlaciPy Code Execution Allowed Without Assessment Active State Validation Affected: 1.0.0 |
| CVE-2026-25753 | 9.8 | Feb 6 | PlaciPy has a Hard-Coded Default Password for All Student Accounts (Account Takeover) Affected: 1.0.0 |
| CVE-2026-25811 | 9.1 | Feb 9 | PlaciPy Email Domain Trust Enables Cross-Tenant Data Access (Multi-Tenant Isolation Failure) Affected: 1.0.0 |
| CVE-2026-25810 | 9.1 | Feb 9 | PlaciPy is Missing Object-Level Authorization in student.submission.routes.ts Affected: 1.0.0 |
| CVE-2026-25876 | 9.1 | Feb 9 | PlaciPy is Missing Authorization on Assessment Results Endpoint Affected: 1.0.0 |
| CVE-2026-25812 | 8.8 | Feb 9 | PlaciPy is Missing CSRF Protection on State-Changing Endpoints Affected: 1.0.0 |
| CVE-2026-25813 | 7.5 | Feb 9 | PlaciPy Exposes Sensitive Data via Application Logs Affected: 1.0.0 |
| CVE-2026-25806 | 6.5 | Feb 9 | PlaciPy has Missing Authorization Checks on Student Management Endpoints (IDOR) Affected: 1.0.0 |
Showing 10