Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: Tournamatch 4.7.1 Clear all filters
TI-2026-86424 CVE-2026-121380 · GHSA-2hw7-c3hq-6x3w

Unauthenticated email disclosure in Tournamatch team invitations

Priority LOW 30

The Tournamatch WordPress plugin before 4.7.1 does not restrict access to its team invitation listing, allowing unauthenticated users to retrieve the email addresses of people invited to join teams.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00251 Published 2026-11-07 Fixed in 4.7.1 CWE-200
TI-2026-86423 CVE-2026-121379 · GHSA-6hvc-jpr4-hmmg

Arbitrary file deletion in Tournamatch WordPress plugin

Priority MEDIUM 41

The Tournamatch WordPress plugin before 4.7.1 does not validate or restrict the path of a previously stored profile or team image before deleting it when a new image is uploaded, allowing users with a role as low as Subs…

CVSS 3.1CRITICAL 9.6 Network Low privileges No interaction EPSS 0.00297 Published 2026-11-07 Fixed in 4.7.1 CWE-73