Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A critical vulnerability in Next.js applications using the App Router with Cache Component allows unauthenticated remote code execution when functions return multiple typed arrays. An immediate upgrade to version 16.4.1 or later is recommended.
A bypass in DOMPurify's template expression sanitization allows split expressions within attached shadow roots to survive element stripping in DOM-returning modes. If an application evaluates sanitized shadow root content, an attacker supplying a shadow root can achieve cross-site scripting or template injection.
A middleware bypass in Sentry-Javascript affects Next.js applications using the tunnel route built with webpack, allowing requests matching tunnel subpaths to skip middleware when authorization is solely enforced there.
A path traversal vulnerability on Windows allows clients communicating with an exposed Vite server to bypass redirect allowlist checks using backslashes. This can permit unauthorized reading of files outside the Vite root directory that the server process has access to.
A vulnerability in OpenClaw browser CDP discovery allows blocked WebSocket URLs to be accepted, potentially enabling lower-trust callers to reach restricted network destinations contrary to configured policy.
Missing origin validation in Storybook preview allows a malicious website to trigger unauthorized file modifications on a running development server. Under specific conditions with user interaction, this could lead to arbitrary code execution on the developer's machine.
An issue in Electron causes HID and USB permission checks from an iframe to receive the top-level frame's origin and details. Applications relying on origin-based logic may grant embedded frames access intended only for the top-level page.
In ApostropheCMS prior to 4.34.0, a REST endpoint bypasses page and field access controls, allowing editor-level users to view restricted pages and fields if they know the document identifier.
A missing authentication check in ApostropheCMS allows unauthenticated users with a standard CSRF cookie to trigger cleanup operations and delete temporary export files, as well as modify job records in the database.
A vulnerability in ApostropheCMS allows any authenticated user to enumerate slugs across the system via the doc/slugTaken endpoint, exposing the existence of private, draft, and administrative content.
ApostropheCMS contains a stored cross-site scripting vulnerability where editor-controlled style field values in widgets are serialized into HTML wrapper attributes without escaping, allowing arbitrary script execution.
A stored cross-site scripting vulnerability in ApostropheCMS allows authenticated users with edit permissions to inject arbitrary HTML and JavaScript via trailing content in color fields. Upgrading to version 4.34.0 or later mitigates this issue.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.