Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
Microsoft Security Advisory CVE-2025-24070: .NET Elevation of Privilege Vulnerability
The SimpleSAMLphp SAML2 library incorrectly verifies signatures for HTTP-Redirect binding
Azure PromptFlow remote code execution related to Jinja templates
Mockoon has a Path Traversal and LFI in the static file serving endpoint
Umbraco Allows a Restricted Editor User to Delete Media Item or Access Unauthorized Content
Umbraco Allows Improper API Access Control to Low-Privilege Users to Data Type Functionality
BlogBuzzTime-for-wp <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
WP Crowdfunding <= 2.1.14 - Missing Authorization to Authenticated (Subscriber+) Post Content Download
binlayerpress <= 1.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Simple Amazon Affiliate <= 1.0.9 - Reflected Cross-Site Scripting
Arbitrary Code Execution via Crafted Keras Config for Model Loading
Accounting for WooCommerce <=1.6.8 - Authenticated (Administrator+) Stored Cross-Site Scripting
Rankchecker.io Integration <= 1.0.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Photo Gallery, Images, Slider in Rbs Image Gallery <= 3.2.21 - Authenticated (Contributor+) Stored Cross-Site Scripting
Quiz and Survey Master (QSM) <= 9.2.0 - Authenticated (Admin+) Stored Cross-Site Scripting
NEX-Forms – Ultimate Form Builder – Contact forms and much more <= 8.8.1 - Unauthenticated Sensitive Information Exposure
Display Template Name <= 1.7.1 - Cross-Site Request Forgery
Google News Editors Picks Feed Generator <= 2.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
GNUCommerce <= 1.5.4 - Reflected Cross-Site Scripting
Maintenance Notice <= 1.0.6 - Cross-Site Request Forgery
WP Hide Admin Bar <= 2.0 - Cross-Site Request Forgery
Easy Image Display <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.