Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filterstar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball
counterpart vulnerable to prototype pollution
CSVTOJSON has a prototype pollution vulnerability
min-document vulnerable to prototype pollution
messageformat prototype pollution vulnerability
Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink
Mailgen: HTML injection vulnerability in plaintext e-mails
`git-comiters` Command Injection vulnerability
@conventional-changelog/git-client has Argument Injection vulnerability
Codex has sandbox bypass due to bug in path configuration logic
@digitalocean/do-markdownit has Type Confusion vulnerability
Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages
@sequa-ai/sequa-mcp has Command Injection vulnerability
Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival
@executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode
is-arrayish@0.3.3 contains malware after npm account takeover
error-ex@1.3.3 contains malware after npm account takeover
color-convert@3.1.1 contains malware after npm account takeover
color-name@2.0.1 contains malware after npm account takeover
debug@4.4.2 contains malware after npm account takeover
color@5.0.1 contains malware after npm account takeover
color-string@2.1.1 contains malware after npm account takeover
simple-swizzle@0.2.3 contains malware after npm account takeover
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.