Not yet rated — under the NVD policy in effect since April 2026, most CVEs are no longer analyzed immediately. The EPSS score (if available) is still shown.
Description
Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.