Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 3,406
Reset filtersCockpit - Content Platform vulnerable to XSS through name or email argument names
Citizen Short Description stored XSS vulnerability through wikitext
Bolt CMS vulnerable to authenticated remote code execution
Citizen vulnerable to Stored XSS through short descriptions
starcitizentools/citizen-skin is vulnerable to Stored XSS attack in the legacy search bar through page descriptions
TabberNeue vulnerable to Stored XSS through wikitext
JuzaWeb CMS is vulnerable to Incorrect Privilege Assignment when installing certain components
Magento Authenticated Security feature bypass
Magento Security feature bypass
drupal/paragraphs_table - SA-CONTRIB-2025-084
drupal/miniorange_2fa - SA-CONTRIB-2025-082
drupal/klaro - SA-CONTRIB-2025-080
drupal/toc_js - SA-CONTRIB-2025-077
Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter
Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution
handcraftedinthealps/goodby-csv has Potential Gadget Chain allowing Remote Code Execution
starcitizentools/citizen-skin allows stored XSS in user registration date message
starcitizentools/citizen-skin allows stored XSS in menu heading message
starcitizentools/citizen-skin allows stored XSS in preference menu heading messages
starcitizentools/citizen-skin allows stored XSS in search no result messages
Citizen skin vulnerable to stored XSS through multiple system messages
drupal/admin_audit_trail - SA-CONTRIB-2025-068
drupal/lightgallery - SA-CONTRIB-2025-069
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.