Medium
CVE-2024-8323
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Critical
CVE-2024-8614
WP JobSearch <= 2.6.7 - Authenticated (Subscriber+) Arbitrary File Upload
Critical
CVE-2024-8615
WP JobSearch <= 2.6.7 - Unauthenticated Arbitrary File Upload
Medium
CVE-2024-51493
OctoPrint has API key access in settings without reauthentication
Medium
CVE-2024-49377
OctoPrint Vulnerable to Reflected XSS in Jinja2 Templates
High
CVE-2024-51132
HAPI FHIR XML External Entity (XXE) vulnerability
Medium
CVE-2024-6626
EleForms – All In One Form Integration including DB for Elementor <= 2.9.9.9 - Missing Authorization
Critical
CVE-2024-9307
mFolio Lite <= 1.2.1 - Missing Authorization to Authenticated (Author+) File Upload via EXE and SVG Files
Low
CVE-2024-51753
@workos-inc/authkit-remix refresh tokens are logged when the debug flag is enabled
Low
CVE-2024-51752
@workos-inc/authkit-nextjs refresh tokens are logged when the debug flag is enabled
High
CVE-2024-10028
Everest Backup – WordPress Cloud Backup, Migration, Restore & Cloning Plugin <= 2.2.13 - Sensitive Invormation Disclosure via procstat Log
Medium
CVE-2024-10084
Contact Form 7 – Dynamic Text Extension <= 4.5 - Information Disclosure via Shortcode
Critical
CVE-2024-48050
In agentscope <=v0.0.4, the file agentscope\web\workstation\workflow_utils.py has the function is_callable_expression. Within this function, the line result = eval(s) poses a security risk as it can d
High
CVE-2024-9946
Social Share, Social Login and Social Comments Plugin – Super Socializer <= 7.13.68 - Authentication Bypass via Disqus OAuth provider
Medium
CVE-2024-10715
MapPress Maps for WordPress <= 2.94.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Map Block
Medium
CVE-2025-24749
EZPZ SAML SP Single Sign On (SSO) <= 1.2.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2024-10471
Everest Forms <= 3.0.4.1 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-10543
Tumult Hype Animations <= 1.9.14 - Missing Authorization
Medium
CVE-2024-10647
WS Form LITE – Drag & Drop Contact Form Builder for WordPress <= 1.9.244 - Reflected Cross-Site Scripting via URL
High
CVE-2024-10020
Heateor Social Login WordPress <= 1.1.35 - Authentication Bypass via Disqus OAuth provider
Medium
CVE-2024-10535
Video Gallery for WooCommerce <= 1.31 - Missing Authorization to Unauthenticated Limited File Deletion
Critical
CVE-2024-51734
Access control vulnerable to user data deletion by anonynmous users
Critical
CVE-2024-51501
CRLF injection in Refit's [Header], [HeaderCollection] and [Authorize] attributes
Medium
CVE-2024-9178
XT Floating Cart for WooCommerce <= 2.8.2 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.