Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
Event Espresso 4 Decaf <= 4.10.44.decaf - Feature Bypass
Big Store <= 1.9.3 - Cross-Site Request Forgery to Arbitrary Plugin Activation
DecaLog <= 3.7.0 - Cross-Site Request Forgery via get_settings_page
Jetpack CRM <= 5.4.4 - Authenticated (Administrator+) Stored Cross-Site Scripting
vantage6 refresh tokens do not expire
Directus vulnerable to Server-Side Request Forgery On File Import
xwiki contains Incorrect Authorization
XWiki-Platform vulnerable to stored Cross-site Scripting via the HTML displayer in Live Data
xwiki vulnerable to Improper Handling of Exceptional Conditions
xwiki contains Exposed Dangerous Method or Function
org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability
XWiki Platform subject to Uncontrolled Resource Consumption
XWiki Platform users may execute anything with superadmin right through comments and async macro
XWiki Platform may allow privilege escalation to programming rights via user's first name
XWiki Platform vulnerable to privilege escalation via async macro and IconThemeSheet from the user profile
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
XWiki Platform packages Expose Sensitive Information to an Unauthorized Actor
Unprivileged XWiki Platform users can make arbitrary select queries using DatabaseListProperty and suggest.vm
Craft CMS Stored Cross-site Scripting Injection Vulnerability
OpenZeppelin Contracts contains Incorrect Calculation
phpseclib Infinite Loop vulnerability
Cockpit Uses Platform-Dependent Third Party Components
CSSTidy - Server-Side Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.