Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,610
lunasvg v3.0.1 was discovered to contain a segmentation violation via the component gray_find_cell
TShock allows chat while not fully connected, possible ban evasion
Django-Unicorn Class Pollution Vulnerability, Leading to XSS, DoS and Authentication Bypass
PhpSpreadsheet allows bypassing of XSS sanitizer using the javascript protocol and special characters
Facilita Form Tracker <= 1.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Social Stream <= 1.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting
WP Custom Post RSS Feed <= 1.0.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Music Press Pro <= 1.4.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Distance Rate Shipping For WooCommerce <= 1.3.4 - Authenticated (Subscriber+) SQL Injection
Upcasted S3 Offload – AWS S3, Digital Ocean Spaces, Backblaze, Minio and more <= 3.0.3 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Stylish Google Sheet Reader <= 4.0 - Reflected Cross-Site Scripting
Dynamic Conditions <= 1.7.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Songkick Concerts and Festivals <= 0.9.7 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Product Blocks for WooCommerce <= 1.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
WP Admin Custom Page <= 1.5.0 - Cross-Site Request Forgery to Stored Cross-Site Scripting
OnePress <= 2.3.14 - Missing Authorization
Simple User Profile <= 1.9 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Cookie Monster <= 1.2.2 - Unauthenticated Local File Inclusion
SendPulse Email Marketing Newsletter <= 2.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Starter Templates by FancyWP <= 2.0.0 - Cross-Site Request Forgery to Arbitrary Plugin Installation
Alert Box Block – Display notice/alerts in the front end <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Video & Photo Gallery for Ultimate Member <= 1.1.2 - Authenticated (Subscriber+) Server-Side Request Forgery
Login-box <= 2.0.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.