High
ghsa-f8pq-3926-8gx5
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Critical
CVE-2023-39532
SES's dynamic import and spread operator provides possible path to arbitrary exfiltration and execution
High
CVE-2023-38704
import-in-the-middle has unsanitized user controlled input in module generation
Medium
CVE-2023-38690
matrix-appservice-irc IRC command injection via admin commands containing newlines
Medium
CVE-2023-38691
matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs
Low
CVE-2023-38700
matrix-appservice-irc events can be crafted to leak parts of targeted messages from other bridged rooms
Medium
CVE-2023-38698
.eth registrar controller can shorten the duration of registered names
High
CVE-2023-37478
pnpm incorrectly parses tar archives relative to specification
Critical
ghsa-8www-cffh-4q98
Anyone with a share link can RESET all website data in Umami
High
ghsa-wxf3-4fvj-vqqx
Unsafe plugins can be installed via pack import by tenant admins
High
CVE-2023-38504
DoS vulnerability for apps with sockets enabled
Medium
CVE-2023-38503
Incorrect Permission Checking for GraphQL Subscriptions
High
CVE-2023-34235
Leaking sensitive user information still possible by filtering on private with prefix fields
Medium
CVE-2023-34093
Making all attributes on a content-type public without noticing it
Critical
CVE-2023-26045
Path traversal and code execution via prototype vulnerability
Medium
CVE-2023-37259
matrix-react-sdk vulnerable to XSS in Export Chat feature
Critical
CVE-2023-37466
vm2 Sandbox Escape vulnerability
Critical
CVE-2023-37903
vm2 Sandbox Escape vulnerability
Low
ghsa-mrr8-v49w-3333
sweetalert2 contains potentially undesirable behavior
High
CVE-2020-26302
is_js vulnerable to Regular Expression Denial of Service
High
CVE-2023-31999
@fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 state
Medium
CVE-2023-34840
angular-ui-notification Cross-site Scripting vulnerability
High
CVE-2023-26134
git-commit-info vulnerable to Command Injection
High
ghsa-5wrg-8fxp-cx9r
passport-wsfed-saml2 Signature Bypass vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.