Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
An authorization omission in ApostropheCMS allows unauthenticated remote callers knowing a document identifier to verify document existence and retrieve locale publication metadata.
Unauthenticated CSV import requests in ApostropheCMS leave rejected uploaded files in the operating system temporary directory. Remote attackers can exploit this behavior by repeatedly submitting large files, exhausting available disk space and causing a denial of service across host services.
ApostropheCMS packages interpolate user-supplied CAPTCHA tokens without URL encoding into outbound verification requests. Attackers can inject query parameters to cause verification failures and disrupt protected login and form workflows.
ApostropheCMS contains a flaw where authenticated users on SQLite or PostgreSQL adapters can delete shared prototype methods via exclusion projections, causing a persistent process-wide denial of service.
ApostropheCMS exposes single-use session migration tokens in URL query parameters, allowing unauthorized clients that obtain the token to take over user sessions and inherit their privileges.
In sanitize-html prior to 2.18.0, an implied close within elements such as <noscript> causes discard regions to end early, allowing raw text content to be erroneously rendered as regular HTML elements.
A denial-of-service vulnerability in Angular Router affects Server-Side Rendering (SSR) on Node.js. Unauthenticated remote attackers can send crafted URLs with empty-path outlet segments to exhaust memory heap or CPU resources, causing worker process crashes and service disruption.
Specially crafted Markdown can trigger quadratic processing time in markdown-it's smartquotes rule when typographer is enabled, potentially causing denial of service.
An open redirect vulnerability in Angular Server-Side Rendering allows unauthenticated attackers to supply crafted dot-segments that bypass URL checks and redirect users off-origin.
The DataStore Table UI in ckan-mcp-server does not validate inbound postMessage origins and targets a wildcard origin for outbound messages. This allows unauthorized frames to spoof content, disrupt handshakes, or observe outbound JSON-RPC messages.
A vulnerability in Claude Code allowed upstream repository maintainers to bypass hash pinning during plugin installation using specially named Git branches, leading to the installation of untrusted code. Users should update to the latest version.
A vulnerability in the ZIP extraction functionality of @appium/support allows arbitrary file writes via crafted symlinks pointing outside the extraction directory. An attacker supplying a malicious archive could overwrite files or potentially achieve code execution with the permissions of the running process.
A cache poisoning vulnerability in Nuxt OG Image allows unauthenticated attackers to modify image content delivered to users due to derivable cache keys on dynamic image routes.
In OpenNext Cloudflare, enabled cache interception can evaluate encoded paths inconsistently, allowing attackers to bypass authorization middleware and retrieve cached route content.
An unauthenticated reflected cross-site scripting vulnerability in TanStack Start allows attackers to execute arbitrary JavaScript in the victim's browser context by tricking them into opening a crafted URL. Affected packages should be upgraded to their patched releases.
A code injection vulnerability in TinaCMS CLI allows arbitrary JavaScript execution during project builds when an unescaped Git branch name is embedded directly into generated client source files.
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment. If an authenticated editor opens a crafted link, an unauthenticated remote attacker can gain arbitrary read and write access to the site's content API as that editor.
A stored cross-site scripting vulnerability in @tinacms/web-components allows attackers with content editing privileges to execute arbitrary scripts via unvalidated link URL schemes in rich-text content.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.