Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A vulnerability in Pillow causes repeated copying of long comments when saving GIF images. This can lead to excessive CPU consumption and potential denial of service when processing untrusted image uploads.
An out-of-bounds read vulnerability in Pillow allows certain decoders to read heap memory past the end of a buffer when processing specific image dimensions. This may disclose adjacent memory into decoded pixel data or cause an application crash.
A path traversal vulnerability on Windows allows clients communicating with an exposed Vite server to bypass redirect allowlist checks using backslashes. This can permit unauthorized reading of files outside the Vite root directory that the server process has access to.
A vulnerability in OpenClaw browser CDP discovery allows blocked WebSocket URLs to be accepted, potentially enabling lower-trust callers to reach restricted network destinations contrary to configured policy.
Applying rank, median, minimum, or maximum filters to zero-width or zero-height images in Pillow triggers a NULL pointer dereference in ImagingExpand, causing Python worker processes to crash and enabling denial of service.
A vulnerability in Pillow allows crafted Microsoft Image Composer (MIC) files with embedded TIFF streams to cause an infinite loop and 100% CPU usage when checking frame counts, leading to denial of service in environments with olefile installed.
A NULL pointer dereference vulnerability in Pillow allows remote attackers to cause a denial of service (process crash) via crafted image files processed through the IPTC loader and Image.merge routine.
A vulnerability in Pillow allows an invalid or double free when rendering text with a stroke from untrusted fonts, potentially leading to memory corruption or crashes.
Pillow lacks sanitization when constructing Ghostscript commands from input filenames, permitting command-line argument injection that can be escalated to remote code execution.
A cross-site scripting vulnerability in the Drupal UI Icons module allows attackers with permission to edit content using an authorized text format to execute arbitrary scripts via the CKEditor widget under uncommon situations.
A vulnerability in the FFmpeg Image Toolkit module allows unsanitized file names to be passed to the ffmpeg command-line tool. An attacker must have permission to upload images to exploit this flaw.
A vulnerability in the Drupal Frontend Editing module fails to properly enforce field access permissions when modifying paragraph items, requiring specific editing roles to exploit.
The ABC theme for Drupal does not sufficiently sanitize menu link titles before inserting them into HTML class attributes. An attacker with permissions to create or modify menu link titles could exploit this issue.
A vulnerability in the Dopup module allows unauthorized users to view the titles of private Webforms due to insufficient entity access checks.
A Cross-Site Request Forgery vulnerability in the Drupal frontend_editing module allows attackers to trick an authenticated editor into deleting or reordering paragraphs on a node.
A cross-site scripting vulnerability in the Drupal Block Attributes module allows attackers with specific permissions to inject malicious attributes into blocks due to insufficient sanitization.
The Drupal Media Bulk Upload module does not sufficiently verify permissions to create specific media types when using the bulk upload form. An attacker must have the bulk upload form permission to exploit this vulnerability.
A vulnerability in the Drupal ui_icons module allows insufficiently validated user-provided icon settings to be rendered.
A module in the Sector distribution for Drupal does not sufficiently sanitize media names, potentially allowing users with media creation or editing permissions to conduct cross-site scripting attacks.
An attacker can trigger an infinite loop in pypdf by supplying a crafted, incomplete PDF file that terminates inside the xref table.
Missing origin validation in Storybook preview allows a malicious website to trigger unauthorized file modifications on a running development server. Under specific conditions with user interaction, this could lead to arbitrary code execution on the developer's machine.
An issue in Electron causes HID and USB permission checks from an iframe to receive the top-level frame's origin and details. Applications relying on origin-based logic may grant embedded frames access intended only for the top-level page.
In ApostropheCMS prior to 4.34.0, a REST endpoint bypasses page and field access controls, allowing editor-level users to view restricted pages and fields if they know the document identifier.
A missing authentication check in ApostropheCMS allows unauthenticated users with a standard CSRF cookie to trigger cleanup operations and delete temporary export files, as well as modify job records in the database.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.