Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,499
Reset filtersGhost: Path Traversal via Locale Setting
Ghost: Remote Code Execution via Theme Translation Files
Ghost: Editors Could Promote Staff Users to Their Own Role
Ghost: Stored XSS via File Uploads on Local Storage
Backstage: Insufficient audience validation in the Cloudflare Access auth provider
Backstage: Improper validation of MkDocs plugin configuration in TechDocs
Backstage: Inconsistent credential enforcement for overlapping proxy routes
Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates
Backstage: Improper input validation in Sentry scaffolder actions
Backstage: Explicit negative email verification can be ignored during shared OAuth profile normalization
Quasar Framework: DOM Clobbering in Quasar openURL() SafariViewController Integration Causes Client-Side Denial of Service
Ghost: Authorization Issue Allowed Author Role to Delete any Post
vm2 contains a sandbox escape vulnerability
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
Backstage: Remote code execution via crafted markdown_extensions in TechDocs mkdocs.yml
Backstage: Improper validation of TechDocs MkDocs configuration
Backstage: Improper input validation in Confluence to Markdown scaffolder module
Backstage: Improper repository path validation in a Scaffolder backend module
Backstage has incorrect authorization in search engine permission filtering
Backstage: Improper entity validation in deprecated Kubernetes services endpoint
Backstage has a sensitive information disclosure in Kubernetes resource queries
Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback
Backstage has improper authorization in GitLab organizational user ingestion
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.