Search results

Question: Hardcoded edition version in card route loader

Status: Open.

#2603 In OWASP/cornucopia;

· theanand108 opened on Mar 11, 2026

Players can vote on cards game time/before/after completed rounds/finished game

Status: Open.

#2568 In OWASP/cornucopia;

· khushal-winner opened on Mar 8, 2026

Critical Authorization Bypass: Self-Voting Vulnerability in Card Voting System

Status: Open.

#2561 In OWASP/cornucopia;

· khushal-winner opened on Mar 7, 2026

🚨Security Issue: play_card API Vulnerable to DoS Attack - 29% Success Rate Confirmed

Status: Open.

#2559 In OWASP/cornucopia;

· khushal-winner opened on Mar 7, 2026

Vote schema has empty changeset with no validation/required fields.

Status: Open.

#2557 In OWASP/cornucopia;

· khushal-winner opened on Mar 7, 2026

Raw Malicious Content Stored in Database Due to Missing Changeset Validation

Status: Open.

#2555 In OWASP/cornucopia;

· khushal-winner opened on Mar 7, 2026

Bug: handle_info in game_live/show.ex always sets requested_round = rounds_played + 1, breaking finished game summary view

Status: Open.

#2548 In OWASP/cornucopia;

· immortal71 opened on Mar 7, 2026

Scores missing from player pages after game ends

copi.owasp.org

enhancementNew feature or requestNew feature or request

Status: Open.

#2539 In OWASP/cornucopia;

· khushal-winner opened on Mar 6, 2026

Bug: knowing a game_id allows you to join (and vote in) games already started

bugSomething isn't workingSomething isn't working

copi.owasp.org

Status: Open.

#2521 In OWASP/cornucopia;

· rewtd opened on Mar 5, 2026

Bug: Missing authorization check in toggle_vote allows players to vote on cards from any game

bugSomething isn't workingSomething isn't working

copi.owasp.org

Status: Open.

#2520 In OWASP/cornucopia;

· Adarshkumar0509 opened on Mar 5, 2026

Duplicate Cards Displayed (Same ID/Content Across Versions) on copi.owasp.org/cards

copi.owasp.org

enhancementNew feature or requestNew feature or request

Status: Open.

#2516 In OWASP/cornucopia;

· khushal-winner opened on Mar 4, 2026

Bug: game_id in URL does not impact access to game state so long as player_id is valid

Status: Open.

#2514 In OWASP/cornucopia;

· khushal-winner opened on Mar 4, 2026