Vulnerabilities

TI-2026-75469 CVE-2026-111683 · GHSA-7m2f-c6pw-4f2h

Missing authorization in Allegro Ralph exposes data center rack API

MEDIUM 57

Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users to bypass rack model permissions because RalphPermission skips checks for views without a queryset.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00294 Published 2026-10-16 No fix listed CWE-862

TI-2024-00481 CVE-2024-0522 · GHSA-pjp9-hrh2-gxrv

Allegro RomPager HTTP POST Request cross-site request forgery

LOW 38

A vulnerability was found in Allegro RomPager 4.01.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00243 Published 2024-01-14 No fix listed CWE-352

TI-2023-10729 CVE-2023-25392 · GHSA-w6q2-48ch-fj26

Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation.

LOW 27

Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00434 Published 2023-04-10 Fixed in 1.6.0 CWE-295

TI-2021-19734 CVE-2021-43978 · GHSA-x8r9-m3mh-g58r

Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its…

LOW 37

Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its binary files, which allows users to access and modify data using the same credentials.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00766 Published 2021-12-08 No fix listed CWE-522

TI-2021-18618 CVE-2021-42110 · GHSA-jx3f-hj4m-h7p9

An issue was discovered in Allegro Windows (formerly Popsy Windows) before 3.3.4156.1.

LOW 34

An issue was discovered in Allegro Windows (formerly Popsy Windows) before 3.3.4156.1.

CVSS 3.1HIGH 7.8 Local No auth User interaction EPSS 0.003 Published 2021-12-08 No fix listed

TI-2000-00470 CVE-2000-0470 · GHSA-976v-3xrm-785r

Allegro RomPager HTTP server allows remote attackers to cause a denial of service via a…

MEDIUM 43

Allegro RomPager HTTP server allows remote attackers to cause a denial of service via a malformed authentication request.

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.0712 Published 2000-10-13 No fix listed

Vulnerabilities

Filters

Missing authorization in Allegro Ralph exposes data center rack API

Allegro RomPager HTTP POST Request cross-site request forgery

Allegro Tech BigFlow <1.6 is vulnerable to Missing SSL Certificate Validation.

Allegro WIndows 3.3.4152.0, embeds software administrator database credentials into its…

An issue was discovered in Allegro Windows (formerly Popsy Windows) before 3.3.4156.1.

Allegro RomPager HTTP server allows remote attackers to cause a denial of service via a…