High
CVE-2024-20719
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Medium
CVE-2024-20718
Magento Open Source allows Cross-Site Request Forgery (CSRF)
Medium
CVE-2024-20716
Magento Open Source allows Uncontrolled Resource Consumption
Medium
CVE-2024-1892
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the XMLFeedSpider class of the scrapy/scrapy project, specifically in the parsing of XML content. By crafting malicious XML conte
High
CVE-2024-25909
WP Media folder <= 5.7.2 - Authenticated (Subscriber+) Arbitrary File Upload
Medium
CVE-2024-1411
PowerPack Addons for Elementor <= 2.7.15 - Authenticated (Contributor+) Stored Cross-Site Scripting via Twitter Buttons Widget
Medium
CVE-2024-25926
Widgets Controller <= 1.1 - Unauthenticated Cross-Site Scripting
Critical
CVE-2024-25928
Sitepact's Contact Form 7 Extension For Klaviyo <= 1.0.5 - Unauthenticated SQL Injection
Critical
CVE-2024-25927
postMash – custom post order <= 1.2.0 - Unauthenticated SQL Injection
Unrated
810
osTicky2 - Other
Unrated
CVE-2024-13245
drupal/ckeditor_lts - SA-CONTRIB-2024-009
Medium
CVE-2024-25125
Absolute path traversal vulnerability in digdag server
Medium
CVE-2024-25917
WP Setup Wizard <= 1.0.8.1 - Authenticated (Subscriber+) Full Database Download
Medium
CVE-2024-25921
Action Network <= 1.4.2 - Reflected Cross-Site Scripting via 'search'
Medium
CVE-2024-25919
Custom Field Template <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via $search_label
Medium
CVE-2024-1126
EventPrime – Events Calendar, Bookings and Tickets <= 3.4.2 - Missing Authorization to Authenticated (Subscriber+) Attendee List Retrieval
Medium
CVE-2024-0604
Best WordPress Gallery Plugin – FooGallery <= 2.4.7 -Authenticated(Administrator+) Stored Cross-Site Scripting via settings
Medium
CVE-2024-25920
WP SMS <= 6.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2024-25923
Community by PeepSo <= 6.2.7.0 - Unauthenticated Sensitive Information Disclosure via Log file
Medium
CVE-2024-0621
Simple Share Buttons Adder <= 8.4.11 - Authenticated(Administrator+) Stored Cross-Site Scripting via CSS Settings
Medium
CVE-2024-1487
Photos and Files Contest Gallery – Contact Form, Upload Form, Social Share and Voting Competition Plugin for WordPress <= 21.3.0 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2024-0708
Landing Page Cat – Coming Soon Page, Maintenance Page & Squeeze Pages <= 1.7.2 - Unauthenticated Information Exposure
Medium
CVE-2023-50905
WP Activity Log <= 4.6.1 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2024-1349
EmbedPress <= 3.9.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.