Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Cross-site Scripting in aurelia-framework
Code injection in @rkesters/gnuplot
OS Command Injection in jscover
OS Command Injection in strong-nginx-controller
Insecure template handling in Express-handlebars
Time-of-check Time-of-use (TOCTOU) Race Condition in chownr
DOM-based cross-site scripting in Froala Editor
Prototype Pollution in Ajv
Deserialization of Untrusted Data in bson
Missing Authentication for Critical Function in Apache TomEE
Expression Language Injection in Netflix Conductor
Injection in Apache Archiva
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-craft
SQL Injection in Hibernate ORM
Server-Side Request Forgery in Karaf
Cross-site scripting in json-sanitizer
Deserialization of Untrusted Data in Jodd
Out of bounds read in json-smart
Cross-site Scripting by SVG upload in xwiki-platform
Cross-Site Request Forgery in xwiki-platform
Improper Certificate Validation in Graylog
Deserialization of Untrusted Data in Apache Dubbo
Apache CXF JMX Integration is vulnerable to a MITM attack
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.