Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A vulnerability in aiohttp allows a subdomain to remove the Host-Only flag from existing parent domain cookies, potentially weakening cookie scoping protections.
The pure-Python parser in aiohttp is vulnerable to HTTP request smuggling when running without standard C extensions. Applications can resolve this issue by updating aiohttp or switching to the default C parser.
A vulnerability in AIOHTTP allows attackers to exhaust file descriptors using specially crafted multipart requests. This can lead to resource exhaustion and potential denial of service.
Default trust stores in affected uv versions trust a root CA with compromised intermediate CA keys. An attacker with access to these compromised keys could forge certificates for arbitrary hostnames, allowing man-in-the-middle attacks on TLS traffic.
Certain certifi releases bundled a root certificate with compromised intermediate keys. An attacker on the network path could issue forged certificates for any hostname and intercept or modify TLS connections.
A vulnerability in JupyterLab allows a command link trust prompt to mark a currently active document as trusted instead of the clicked one, potentially allowing buttons in untrusted documents to execute without confirmation.
A vulnerability in aiohttp allows an attacker to keep an idle connection open indefinitely before sending data because the keepalive timeout was not enforced during the initial portion of a request.
A vulnerability in AIOHTTP allowed shared cookies marked with the Secure attribute to potentially be transmitted over unencrypted requests. Upgrading to version 3.14.4 or later resolves this issue.
Multiple issues in aiohttp can cause excessive or unbounded memory usage and high CPU consumption when handling attacker-controlled requests, leading to resource exhaustion.
A missing comma in Mercury's blocklist leaves the /api/terminals endpoint unprotected, allowing unauthenticated network attackers to spawn an interactive OS-level root shell.
Incomplete cpp #include hardening in the Graphify Fortran extractor allows arbitrary host files to be read and exfiltrated into the knowledge graph when indexing an untrusted repository.
An unauthenticated remote code execution vulnerability in Mercury allows network clients to execute arbitrary Python code as the server process user on default deployments due to anonymous access to kernel endpoints.
LoopX serve-status uses an overly permissive CORS policy with wildcard headers on unauthenticated loopback read endpoints. This allows malicious websites visited by the operator to exfiltrate control-plane state and private Markdown files from registered goal repositories without user interaction.
An argument injection vulnerability in the Claude Agent SDK for Python allows arbitrary command execution at CLI startup when an application passes untrusted input as a session ID. Users are advised to upgrade to the latest package version.
Exposing Pipecat's development runner to untrusted networks allows unauthenticated callers to create bot sessions and paid Daily rooms. This can lead to unauthorized bot interactions, local resource exhaustion, and consumption of third-party service quotas.
A path traversal vulnerability in ClickMigrate allows an attacker who controls the migration name argument to create a file in an arbitrary writable location outside the intended migrations directory.
A denial-of-service vulnerability in tinytag allows malformed M4A files containing a zero-sized sub-atom to trigger an infinite loop during parsing.
Apprise HTTP notification plugins and loaders follow redirects by default while re-sending configured authentication headers. If a configured destination is compromised or subjected to a man-in-the-middle attack, secrets can be leaked to an arbitrary cross-origin host.
A path traversal vulnerability in Shiny for Python allows unauthenticated remote attackers to probe file existence and JSON validity via bookmark restoration, or read arbitrary files when server-side bookmarking and file inputs are configured.
An authorization bypass in pacioli's document-layer consent gate allows nested operations to cancel caller-specified pre-existing documents without human consent markers or denial audit entries.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.