Critical
CVE-2024-27448
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
High
CVE-2024-31206
dectalk-tts Uses Unencrypted HTTP Request
Low
CVE-2024-30261
Undici's fetch with integrity option is too lax when algorithm is specified but hash value is in incorrect
Low
CVE-2024-30260
Undici's Proxy-Authorization header not cleared on cross-origin redirect for dispatch, request, stream, pipeline
Medium
CVE-2024-31207
Vite's `server.fs.deny` did not deny requests for patterns with directories.
High
CVE-2024-30250
In Astro-Shield, setting a correct `integrity` attribute to injected code allows to bypass the allow-lists
High
CVE-2024-29900
@electron/packager's build process memory potentially leaked into final executable
Medium
CVE-2024-29901
@workos-inc/authkit-nextjs session replay vulnerability
High
CVE-2024-29896
Content-Security-Policy header generation in middleware could be compromised by malicious injections
Medium
CVE-2024-29316
Incorrect Access Control in NodeBB
High
CVE-2024-25354
domain-suffix RegEx Denial of Service
High
CVE-2024-21505
web3-utils Prototype Pollution vulnerability
Medium
CVE-2024-29203
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling iframes
Medium
CVE-2024-29881
TinyMCE Cross-Site Scripting (XSS) vulnerability in handling external SVG files through Object or Embed elements
Medium
CVE-2024-29041
Express.js Open Redirect in malformed URLs
Medium
CVE-2024-28246
KaTeX missing normalization of the protocol in URLs allows bypassing forbidden protocols
Medium
CVE-2024-28245
KaTeX's `\includegraphics` does not escape filename
Medium
CVE-2024-28244
KaTeX's maxExpand bypassed by Unicode sub/superscripts
Medium
CVE-2024-28243
KaTeX's maxExpand bypassed by `\edef`
High
CVE-2024-29194
OneUptime Vulnerable to a Privilege Escalation via Local Storage Key Manipulation
Critical
CVE-2024-29650
@thi.ng/paths Prototype Pollution vulnerability
Medium
CVE-2024-29042
Cache Poisoning Vulnerability
Medium
CVE-2024-28863
Denial of service while parsing a tar file due to lack of folders count validation
Medium
CVE-2024-29272
VvvebJs Arbitrary File Upload vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.