Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,728
Yeswiki Vulnerable to Authenticated Reflected Cross-site Scripting
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
Yeswiki Vulnerable to Unauthenticated Reflected Cross-site Scripting
org.xwiki.platform:xwiki-platform-security-requiredrights-default required rights analysis doesn't consider TextAreas with default content type
org.xwiki.platform:xwiki-platform-component-wiki provides no warning when granting XWiki.ComponentClass programming right
The lesscss script service allows cache clearing without programming right
Solr script service doesn't take dropped programming right into account
org.xwiki.platform:xwiki-platform-wysiwyg-api Open Redirect vulnerability
Seraphinite Accelerator <= 2.27.21 - Cross-Site Request Forgery to Multiple Administrative Actions
Total Donations <= 3.0.8 - Unauthenticated Stored Cross-Site Scripting
Custom PC Builder Lite for WooCommerce <= 1.0.1 - Missing Authorization to Unauthenticated Settings Update
BP Messages Tool <= 2.2 - Reflected Cross-Site Scripting
Order Delivery Date for WP e-Commerce Pro <= 12.4.0 - Reflected Cross-Site Scripting
Syndicate Out <= 0.9 - Unauthenticated Stored Cross-Site Scripting
KLEO < 5.4.4 - Missing Authorization
WP Statistics – The Most Popular Privacy-Friendly Analytics Plugin <= 14.13.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Update
Apache Tomcat Denial of Service via invalid HTTP priority header
Apache Tomcat Rewrite rule bypass
n8n Vulnerable to Stored XSS through Attachments View Endpoint
NodeJS Driver for Snowflake has race condition when checking access to Easy Logging configuration file
Snowflake Connector for .NET has race condition when checking access to Easy Logging configuration file
Gutenverse <= 2.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via countdown Block
Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.