Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,632
The WikiManager REST API allows any user to create wikis
XWiki allows unregistered users to access private pages information through REST endpoint
XWiki uses the wrong wiki reference in AuthorizationManager
Nuxt allows DOS via cache poisoning with payload rendering response
Drupal core - SA-CORE-2025-004
Jenkins Zoho QEngine Plugin Displays Unmasked API Keys
Jenkins AnchorChain Plugin Has a Cross-Site Scripting (XSS) Vulnerability
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File Inclusion
Event Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status Update
Sylius PayPal Plugin has an Order Manipulation Vulnerability after PayPal Checkout
Custom Twitter Feeds <= 2.2.5 - Cross-Site Request Forgery to Cache Reset via ctf_clear_cache_admin Function
vLLM Allows Remote Code Execution via Mooncake Integration
vLLM denial of service via outlines unbounded cache on disk
Fast-JWT Improperly Validates iss Claims
Clickstorm SEO Allows Cross-Site Scripting (XSS)
Additional TCA Allows Cross-Site Scripting (XSS)
Frontend Post Submission <= 1.0 - Reflected Cross-Site Scripting
En Masse <= 1.0 - Reflected Cross-Site Scripting
custom-post-edit <= 1.0.4 - Reflected Cross-Site Scripting
Age Gate <= 3.5.3 - Unauthenticated Local PHP File Inclusion via 'lang'
Off Page SEO <= 3.0.3 - Reflected Cross-Site Scripting
Hide My WP Ghost <= 5.4.01 - Unauthenticated Local File Inclusion
Pixobe Cartography <= 1.0.1 - Reflected Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.