Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A path traversal vulnerability on Windows allows clients communicating with an exposed Vite server to bypass redirect allowlist checks using backslashes. This can permit unauthorized reading of files outside the Vite root directory that the server process has access to.
A vulnerability in OpenClaw browser CDP discovery allows blocked WebSocket URLs to be accepted, potentially enabling lower-trust callers to reach restricted network destinations contrary to configured policy.
Missing origin validation in Storybook preview allows a malicious website to trigger unauthorized file modifications on a running development server. Under specific conditions with user interaction, this could lead to arbitrary code execution on the developer's machine.
A vulnerability in Vite allows cross-origin script execution when a development server passes an unmodified request URL to custom middleware. An attacker can direct a user to a malicious site that executes arbitrary scripts within the context of the development server page.
In Vite dev servers running on Node.js or Deno, specially crafted requests can disclose the initial bytes of arbitrary files outside the configured access boundaries through WebAssembly parser error messages.
In Vite on non-Windows systems, an issue allows files outside the configured root to be served if a project imports a path matching an absolute system path and the development server is exposed to the network. Updating to a patched version resolves the issue.
A URL parsing discrepancy in the Angular HTTP client can cause cross-site request forgery tokens to leak to external domains during mutating requests. Attackers can leverage these leaked tokens to execute unauthorized actions against an authenticated user session.
A vulnerability in launch-editor allows attackers to bypass file existence checks on Windows using a specially crafted path. When combined with argument escaping issues, this can lead to operating system command injection if an attacker controls the file path.
Under Windows, launch-editor does not properly escape percent signs, allowing potential command execution if an attacker can manipulate filenames, environment variables, or NTFS streams.
A vulnerability in ApostropheCMS allows the general public to access user objects through relationships if templates expose them, as viewRole is not enforced for unauthenticated public users.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.