Critical
CVE-2023-36258
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2023-36814
Products.CMFCore unauthenticated denial of service and crash via unchecked use of input with Python's marshal module
High
CVE-2023-36053
In Django 3.2 before 3.2.20, 4 before 4.1.10, and 4.2 before 4.2.3, EmailValidator and URLValidator are subject to a potential ReDoS (regular expression denial of service) attack via a very large numb
Critical
CVE-2023-35797
Apache Airflow Hive Provider Beeline remote code execution with Principal
Medium
CVE-2023-3345
Masteriyo - LMS for WordPress <= 1.6.7 - Sensitive Information Exposure
Medium
CVE-2023-3248
All-in-one Floating Contact Form <= 2.1.1 - Authenticated(Administrator+) Stored Cross-Site Scripting via plugin settings
Medium
CVE-2023-2309
wpForo Forum <= 2.1.8 - Reflected Cross-Site Scripting via 'wpforo_debug'
Medium
CVE-2023-3344
Auto Location for WP Job Manager via Google <= 1.0 - Authenticated (Administrator+) Stored Cross Site Scripting
Medium
CVE-2023-26136
tough-cookie Prototype Pollution vulnerability
High
CVE-2023-30589
llhttp vulnerable to HTTP request smuggling
Medium
e8596412-53d5-45ed-998a-49799bd269d0
Image Regenerate & Select Crop <= 7.1.0 - Cross-Site Request Forgery on multiple AJAX actions
Medium
b0eb165f-c979-4318-8362-ca47500ed845
Image Regenerate & Select Crop <= 7.1.0 - Missing Authorization on multiple AJAX actions
Medium
50f69182-66c0-4d3a-aabe-015b72937f3e
WP Social AutoConnect <= 4.6.1 - Cross-Site Request Forgery via jfb_admin_page
Critical
CVE-2023-36812
Remote Code Execution for 2.4.1 and earlier
Critical
CVE-2023-31543
A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository server.
Critical
CVE-2023-36468
Upgrading doesn't prevent exploiting vulnerable XWiki documents
Critical
CVE-2023-36469
XWiki Platform vulnerable to Code injection through NotificationRSSService
Critical
CVE-2023-36470
XWiki Platform vulnerable to Code Injection in icon themes
Critical
CVE-2023-36471
org.xwiki.commons:xwiki-commons-xml's HTML sanitizer allows form elements in restricted
Critical
CVE-2023-36475
Parse Server vulnerable to remote code execution via MongoDB BSON parser through prototype pollution
Critical
CVE-2023-36477
XWiki Platform vulnerable to persistent Cross-site Scripting through CKEditor Configuration pages
High
CVE-2023-2422
Keycloak vulnerable to Improper Client Certificate Validation for OAuth/OpenID clients
Critical
CVE-2022-4361
Keycloak vulnerable to cross-site scripting when validating URI-schemes on SAML and OIDC
Medium
CVE-2023-1664
Keycloak Untrusted Certificate Validation vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.