Understand vulnerabilities.
Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A denial-of-service vulnerability in markdown-it allows remote attackers to block the Node.js event loop via crafted multi-line link reference definitions. Processing unclosed definitions causes quadratic execution time under default configurations.
A URL parsing discrepancy in the Angular HTTP client can cause cross-site request forgery tokens to leak to external domains during mutating requests. Attackers can leverage these leaked tokens to execute unauthorized actions against an authenticated user session.
In affected versions of the MCP TypeScript SDK, an unauthenticated HTTP request within default size limits can exhaust server memory during validation. This allows attackers to crash the server process through denial of service.
When HTML is enabled in markdown-it, parsing repeated unterminated HTML constructs takes quadratic time. This allows crafted input to block the Node.js event loop and lead to denial of service.
A vulnerability in the MCP TypeScript server SDK causes messages and notifications to be delivered to the wrong HTTP client when server or transport instances are shared, leading to data exposure.
A vulnerability in launch-editor allows attackers to bypass file existence checks on Windows using a specially crafted path. When combined with argument escaping issues, this can lead to operating system command injection if an attacker controls the file path.
A vulnerability in the MCP TypeScript SDK allows servers using bearer authentication to accept tokens issued for other services when sharing an authorization server. Attackers could potentially reuse valid tokens across services to gain unauthorized access unless audience validation is explicitly configured.
In affected versions of MCP TypeScript SDK, experimental tasks were not bound to the session that created them. Clients sharing a handler could list, read, and cancel each other's tasks.
ApostropheCMS notification endpoints fail to verify authentication or ownership. An unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notifications.
Under Windows, launch-editor does not properly escape percent signs, allowing potential command execution if an attacker can manipulate filenames, environment variables, or NTFS streams.
In affected versions of the MCP TypeScript client SDK, HTTP client transports and OAuth requests followed cross-origin redirects, potentially exposing custom headers and request bodies to external hosts.
A vulnerability in ApostropheCMS allows the general public to access user objects through relationships if templates expose them, as viewRole is not enforced for unauthenticated public users.
An authorization bypass in the ApostropheCMS page REST API allows unauthenticated visitors and low-privileged contributors to read restricted page content and site structure metadata.
A substring check in ApostropheCMS import-export tar extraction fails to catch relative directory traversal paths, allowing authenticated users to crash the Node process.
A client-side prototype pollution vulnerability in ApostropheCMS allows attackers to execute arbitrary JavaScript in the context of an authenticated user session if the victim visits a crafted link, potentially leading to unauthorized data access and administrative compromise.
A lack of attempt throttling on ApostropheCMS's authenticated password-change endpoint allows attackers with an active session to repeatedly guess the current password without lockout or rate limiting, potentially enabling account takeover if the password is weak.
In ApostropheCMS before 4.33.0, the exist-in-locale API allows authenticated low-privilege users to determine whether restricted documents and drafts exist and retrieve localized identifiers without proper document-level authorization checks.
A namespace prefix bypass in sanitize-html allows SVG SMIL animation elements to evade URL sink restrictions, potentially enabling cross-site scripting attacks when SVG elements are allowed.
ApostropheCMS uploadfs with the Azure backend and SAS enabled inadvertently exposes container-level SAS tokens in public attachment links. This allows unauthenticated users to read, overwrite, delete, or list blobs stored in the container.
In @apostrophecms/ai-helper, an authenticated editor can supply a crafted Host header to control the server-side image fetch origin, enabling SSRF against internal hosts and ports.
A NoSQL injection vulnerability in the ApostropheCMS import-export module allows authenticated users to match and overwrite unintended documents using crafted update-key values.
An authorization omission in ApostropheCMS allows unauthenticated remote callers knowing a document identifier to verify document existence and retrieve locale publication metadata.
Unauthenticated CSV import requests in ApostropheCMS leave rejected uploaded files in the operating system temporary directory. Remote attackers can exploit this behavior by repeatedly submitting large files, exhausting available disk space and causing a denial of service across host services.
ApostropheCMS packages interpolate user-supplied CAPTCHA tokens without URL encoding into outbound verification requests. Attackers can inject query parameters to cause verification failures and disrupt protected login and form workflows.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.
Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.
A daily digest of new vulnerabilities, critical ones included.
Notifications about important updates.
Practical advice on application security and monitoring.
Type at least two characters to see suggestions.
/opens search↑↓pick a resultEntergo to the resultESCcloses
We respect your privacy
We use cookies to keep the site working and to learn what to improve on it. Without your consent only the essentials run. You can change your choice at any time from the footer.
Read the privacy policy
Cookie settings
Decide what you agree to. Required cookies are always on - without them the site could not even remember this choice.
Read the privacy policy
Always on
Your session, form protection and the memory of this very choice. The site does not work without them, so they cannot be turned off.
Remembering your language, theme and accessibility settings so you do not have to pick them on every visit.
Anonymous visit statistics: which pages get read and where people get lost. This is what we improve the site on.
Measuring how well our ads work and matching them to your interests on external services.
