Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A critical vulnerability in Next.js applications using the App Router with Cache Component allows unauthenticated remote code execution when functions return multiple typed arrays. An immediate upgrade to version 16.4.1 or later is recommended.
A bypass in DOMPurify's template expression sanitization allows split expressions within attached shadow roots to survive element stripping in DOM-returning modes. If an application evaluates sanitized shadow root content, an attacker supplying a shadow root can achieve cross-site scripting or template injection.
A middleware bypass in Sentry-Javascript affects Next.js applications using the tunnel route built with webpack, allowing requests matching tunnel subpaths to skip middleware when authorization is solely enforced there.
A path traversal vulnerability on Windows allows clients communicating with an exposed Vite server to bypass redirect allowlist checks using backslashes. This can permit unauthorized reading of files outside the Vite root directory that the server process has access to.
A vulnerability in OpenClaw browser CDP discovery allows blocked WebSocket URLs to be accepted, potentially enabling lower-trust callers to reach restricted network destinations contrary to configured policy.
Missing origin validation in Storybook preview allows a malicious website to trigger unauthorized file modifications on a running development server. Under specific conditions with user interaction, this could lead to arbitrary code execution on the developer's machine.
An issue in Electron causes HID and USB permission checks from an iframe to receive the top-level frame's origin and details. Applications relying on origin-based logic may grant embedded frames access intended only for the top-level page.
In ApostropheCMS prior to 4.34.0, a REST endpoint bypasses page and field access controls, allowing editor-level users to view restricted pages and fields if they know the document identifier.
A missing authentication check in ApostropheCMS allows unauthenticated users with a standard CSRF cookie to trigger cleanup operations and delete temporary export files, as well as modify job records in the database.
A vulnerability in ApostropheCMS allows any authenticated user to enumerate slugs across the system via the doc/slugTaken endpoint, exposing the existence of private, draft, and administrative content.
ApostropheCMS contains a stored cross-site scripting vulnerability where editor-controlled style field values in widgets are serialized into HTML wrapper attributes without escaping, allowing arbitrary script execution.
A stored cross-site scripting vulnerability in ApostropheCMS allows authenticated users with edit permissions to inject arbitrary HTML and JavaScript via trailing content in color fields. Upgrading to version 4.34.0 or later mitigates this issue.
A vulnerability in ApostropheCMS allows the import API to bypass publication roles, enabling users with edit-only permissions to create, replace, or delete published content without required publishing authority.
A vulnerability in ApostropheCMS allows authenticated users to exhaust server storage during archive extraction due to missing decompression quotas and failure cleanup, potentially causing a denial of service.
In @apostrophecms/import-export, the overrideDuplicates continuation accepts client-supplied replacement choices, allowing contributors to overwrite published content without publication authority.
A vulnerability in Vite allows cross-origin script execution when a development server passes an unmodified request URL to custom middleware. An attacker can direct a user to a malicious site that executes arbitrary scripts within the context of the development server page.
In Vite dev servers running on Node.js or Deno, specially crafted requests can disclose the initial bytes of arbitrary files outside the configured access boundaries through WebAssembly parser error messages.
In Vite on non-Windows systems, an issue allows files outside the configured root to be served if a project imports a path matching an absolute system path and the development server is exposed to the network. Updating to a patched version resolves the issue.
An unauthenticated resource exhaustion vulnerability in ApostropheCMS allows remote attackers to trigger large chunked upload processing and cleanup operations without authentication, potentially leading to denial of service.
A denial-of-service vulnerability in markdown-it allows remote attackers to block the Node.js event loop via crafted multi-line link reference definitions. Processing unclosed definitions causes quadratic execution time under default configurations.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.