Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 524
Reset filtersMicrosoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability
AngleSharp HTML5 Spec Compliance: mXSS via annotation-xml HTML Integration Point Bypass
Prompty: Arbitrary file read via file reference expansion
dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS
Umbraco.AI discloses sensitive application configuration values
Scriban: Template Writes to Arbitrary CLR Properties via `TypedObjectAccessor` (Mass Assignment + `private` / `init` / `internal` Setter Bypass)
Steeltoe: OAEP setting silently selects PKCS#1 v1.5 padding
Steeltoe: TLS private keys written to /tmp with default permissions, never deleted
Steeltoe's static JWKS cache shared across schemes and never invalidated
Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission
Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords
Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch
Steeltoe vulnerable to management-port isolation bypass via spoofed Host header
CefSharp.Common: `FolderSchemeHandlerFactory` path boundary check can expose files outside the configured root folder
Microsoft.OpenAPI: Circular schema references may terminate OpenAPI parsing
Scriban: ExpressionDepthLimit guard is non-enforcing — parser-recursion DoS in 6.6.0–7.2.0 (incomplete fix for GHSA-wgh7-7m3c-fx25 / GHSA-p6q4-fgr8-vx4p)
Scriban: array * int (ScriptArray<T>.TryEvaluate) bypasses LoopLimit — incomplete fix for GHSA-c875-h985-hvrc, missed sibling of GHSA-24c8-4792-22hx
ImageMagick has a Use-After-Free when allocation in CheckPrimitiveExtent fails
ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition
MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments
MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings
MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions
MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.