Medium
ghsa-hfxh-rjv7-2369
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,493
Reset filters
Medium
CVE-2023-48223
JWT Algorithm Confusion
High
CVE-2023-48238
json-web-token library is vulnerable to a JWT algorithm confusion attack
Medium
CVE-2023-48219
TinyMCE vulnerable to mutation Cross-site Scripting via special characters in unescaped text nodes
High
CVE-2023-46119
Parse Server may crash when uploading file without extension
High
CVE-2023-45820
Directus crashes on invalid WebSocket message
Critical
CVE-2023-5572
Server-Side Request Forgery (SSRF) in vriteio/vrite
High
CVE-2023-44400
Uptime Kuma has Persistentent User Sessions
High
ghsa-mvrp-3cvx-c325
Zod denial of service vulnerability during email validation
High
CVE-2023-26152
static-server Path Traversal vulnerability
Critical
CVE-2023-31719
FUXA SQL Injection vulnerability
High
CVE-2023-31718
FUXA local file inclusion vulnerability
High
CVE-2023-31717
FUXA SQL Injection vulnerability
High
CVE-2023-38507
Strapi Improper Rate Limiting vulnerability
High
CVE-2023-41058
Trigger `beforeFind` not invoked in internal query pipeline when fetching pointer
Low
ghsa-j5g3-5c8r-7qfx
Prevent logging invalid header values
Medium
CVE-2023-38691
matrix-appservice-bridge doesn't verify the sub parameter of an openId token exhange, allowing unauthorized access to provisioning APIs
Medium
CVE-2023-3348
Cloudflare Wrangler directory traversal vulnerability
High
CVE-2023-37478
pnpm incorrectly parses tar archives relative to specification
High
ghsa-wxf3-4fvj-vqqx
Unsafe plugins can be installed via pack import by tenant admins
Medium
CVE-2023-37259
matrix-react-sdk vulnerable to XSS in Export Chat feature
High
CVE-2022-24441
snyk Code Injection vulnerability
High
CVE-2023-31999
@fastify/oauth2 vulnerable to Cross Site Request Forgery due to reused Oauth2 state
Critical
CVE-2023-36475
Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.