Understand vulnerabilities.
Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Missing origin validation in Storybook preview allows a malicious website to trigger unauthorized file modifications on a running development server. Under specific conditions with user interaction, this could lead to arbitrary code execution on the developer's machine.
A missing authentication check in ApostropheCMS allows unauthenticated users with a standard CSRF cookie to trigger cleanup operations and delete temporary export files, as well as modify job records in the database.
ApostropheCMS contains a stored cross-site scripting vulnerability where editor-controlled style field values in widgets are serialized into HTML wrapper attributes without escaping, allowing arbitrary script execution.
A stored cross-site scripting vulnerability in ApostropheCMS allows authenticated users with edit permissions to inject arbitrary HTML and JavaScript via trailing content in color fields. Upgrading to version 4.34.0 or later mitigates this issue.
A vulnerability in ApostropheCMS allows the import API to bypass publication roles, enabling users with edit-only permissions to create, replace, or delete published content without required publishing authority.
A vulnerability in ApostropheCMS allows authenticated users to exhaust server storage during archive extraction due to missing decompression quotas and failure cleanup, potentially causing a denial of service.
In @apostrophecms/import-export, the overrideDuplicates continuation accepts client-supplied replacement choices, allowing contributors to overwrite published content without publication authority.
A vulnerability in Vite allows cross-origin script execution when a development server passes an unmodified request URL to custom middleware. An attacker can direct a user to a malicious site that executes arbitrary scripts within the context of the development server page.
In Vite dev servers running on Node.js or Deno, specially crafted requests can disclose the initial bytes of arbitrary files outside the configured access boundaries through WebAssembly parser error messages.
In Vite on non-Windows systems, an issue allows files outside the configured root to be served if a project imports a path matching an absolute system path and the development server is exposed to the network. Updating to a patched version resolves the issue.
An unauthenticated resource exhaustion vulnerability in ApostropheCMS allows remote attackers to trigger large chunked upload processing and cleanup operations without authentication, potentially leading to denial of service.
A denial-of-service vulnerability in markdown-it allows remote attackers to block the Node.js event loop via crafted multi-line link reference definitions. Processing unclosed definitions causes quadratic execution time under default configurations.
A URL parsing discrepancy in the Angular HTTP client can cause cross-site request forgery tokens to leak to external domains during mutating requests. Attackers can leverage these leaked tokens to execute unauthorized actions against an authenticated user session.
In affected versions of the MCP TypeScript SDK, an unauthenticated HTTP request within default size limits can exhaust server memory during validation. This allows attackers to crash the server process through denial of service.
A vulnerability in the MCP TypeScript server SDK causes messages and notifications to be delivered to the wrong HTTP client when server or transport instances are shared, leading to data exposure.
A vulnerability in the MCP TypeScript SDK allows servers using bearer authentication to accept tokens issued for other services when sharing an authorization server. Attackers could potentially reuse valid tokens across services to gain unauthorized access unless audience validation is explicitly configured.
In affected versions of MCP TypeScript SDK, experimental tasks were not bound to the session that created them. Clients sharing a handler could list, read, and cancel each other's tasks.
In affected versions of the MCP TypeScript client SDK, HTTP client transports and OAuth requests followed cross-origin redirects, potentially exposing custom headers and request bodies to external hosts.
A substring check in ApostropheCMS import-export tar extraction fails to catch relative directory traversal paths, allowing authenticated users to crash the Node process.
A client-side prototype pollution vulnerability in ApostropheCMS allows attackers to execute arbitrary JavaScript in the context of an authenticated user session if the victim visits a crafted link, potentially leading to unauthorized data access and administrative compromise.
A lack of attempt throttling on ApostropheCMS's authenticated password-change endpoint allows attackers with an active session to repeatedly guess the current password without lockout or rate limiting, potentially enabling account takeover if the password is weak.
In ApostropheCMS before 4.33.0, the exist-in-locale API allows authenticated low-privilege users to determine whether restricted documents and drafts exist and retrieve localized identifiers without proper document-level authorization checks.
A namespace prefix bypass in sanitize-html allows SVG SMIL animation elements to evade URL sink restrictions, potentially enabling cross-site scripting attacks when SVG elements are allowed.
ApostropheCMS uploadfs with the Azure backend and SAS enabled inadvertently exposes container-level SAS tokens in public attachment links. This allows unauthenticated users to read, overwrite, delete, or list blobs stored in the container.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.
Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.
A daily digest of new vulnerabilities, critical ones included.
Notifications about important updates.
Practical advice on application security and monitoring.
Type at least two characters to see suggestions.
/opens search↑↓pick a resultEntergo to the resultESCcloses
We respect your privacy
We use cookies to keep the site working and to learn what to improve on it. Without your consent only the essentials run. You can change your choice at any time from the footer.
Read the privacy policy
Cookie settings
Decide what you agree to. Required cookies are always on - without them the site could not even remember this choice.
Read the privacy policy
Always on
Your session, form protection and the memory of this very choice. The site does not work without them, so they cannot be turned off.
Remembering your language, theme and accessibility settings so you do not have to pick them on every visit.
Anonymous visit statistics: which pages get read and where people get lost. This is what we improve the site on.
Measuring how well our ads work and matching them to your interests on external services.
