Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filtersCache Poisoning Vulnerability
Denial of service while parsing a tar file due to lack of folders count validation
VvvebJs Arbitrary File Upload vulnerability
VvvebJs Reflected Cross-Site Scripting (XSS) vulnerability
Path traversal in webpack-dev-middleware
Cross-site scripting in Survey Creator
TurboBoost Commands vulnerable to arbitrary method invocation
follow-redirects' Proxy-Authorization header kept across hosts
URL Redirection to Untrusted Site in OAuth2/OpenID in directus
Session Token in URL in directus
StimulusReflex arbitrary method call
jose vulnerable to resource exhaustion via specifically crafted JWE with compressed plaintext
RSSHub vulnerable to Server-Side Request Forgery
JSONata expression can pollute the "Object" prototype
ZDI-CAN-19105: Parse Server literalizeRegexPart SQL Injection
Directus has MySQL accent insensitive email matching
Nteract Remote Code Execution vulnerability
@nfid/embed has compromised private key due to @dfinity/auth-client producing insecure session keys
es5-ext vulnerable to Regular Expression Denial of Service in `function#copy` and `function#toStringTokens`
sanitize-html Information Exposure vulnerability
agent-js: Insecure Key Generation in `Ed25519KeyIdentity.generate`
MeshCentral cross-site websocket hijacking (CSWSH) vulnerability
Cross-site Scripting in electron-pdf
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.