CVE-2026-92565 is an information disclosure vulnerability in Rallly before version 4.15.0. The vulnerability exists in the polls.get tRPC procedure, which returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can exploit this by accessing a poll's urlId from public invite links to retrieve sensitive invitee information, regardless of privacy settings.
A cross-site scripting vulnerability exists in lukevella rallly up to 4.7.4, affecting the Reset Password Handler component. The issue can be exploited remotely by manipulating the redirectTo argument. This could potentially allow an attacker to execute malicious scripts in the context of a user's session, leading to unauthorized actions or data exposure. Upgrading to version 4.8.0 mitigates this issue. D [truncated]
