Critical
CVE-2023-6038
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Critical
CVE-2023-6015
MLflow allowed arbitrary files to be PUT onto the server
Critical
CVE-2023-6018
Remote Code Execution due to Full Controled File Write in mlflow
High
CVE-2023-48054
Missing SSL certificate validation in localstack v2.3.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
High
CVE-2023-48056
PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.
High
CVE-2023-48052
HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack
High
ghsa-54xq-cgqr-rpm3
sharp vulnerability in libwebp dependency CVE-2023-4863
High
CVE-2023-26031
Apache Hadoop allows local user to gain root privileges
Medium
CVE-2023-47836
WP Meta and Date Remover <= 2.3.0 - Cross-Site Request Forgery via updateSettings
Medium
CVE-2023-47835
ARI Stream Quiz <= 1.2.32 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2023-47788
Jetpack <= 12.6.2 - Improper Authorization via WPCom External Media REST endpoints
Medium
CVE-2023-47831
DrawIt (draw.io) <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2023-5605
URL Shortify <= 1.7.9 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2023-47828
wpMandrill <= 1.33 - Missing Authorization via getAjaxStats
Medium
CVE-2023-47833
Theater for WordPress <= 0.18.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Low
CVE-2023-47826
Restaurant & Cafe Addon for Elementor <= 1.5.3 - Missing Authorization via multiple AJAX functions
Medium
CVE-2023-47837
ARMember <= 4.0.10 - Authenticated (Subscriber+) Membership Plan Bypass
Medium
CVE-2023-47819
Easy Call Now by ThikShare <= 1.1.0 - Cross-Site Request Forgery via settings_page
Medium
CVE-2023-47774
Jetpack < 12.7 - Authenticated(Contributor+) Clickjacking via Iframe Injection
Medium
CVE-2023-47830
Live Preview for Contact Form 7 <= 1.2.0 - Missing Authorization via update_option
Medium
CVE-2023-47791
Leadster <= 1.1.2 - Cross-Site Request Forgery via leadster_script_code_action
Medium
CVE-2023-45050
Jetpack <= 12.8-a.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via block attribute
Medium
CVE-2023-47825
WP EXtra <= 6.4 - Cross-Site Request Forgery ToolImport
Medium
CVE-2023-47824
Legal Pages <= 1.3.8 - Cross-Site Request Forgery via moveToTrash and fetch_and_insert_template_data
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.