Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
WordPress Core < 5.4.2 - Comment Disclosure
Advanced Custom Fields <= 5.8.11 - Cross-Site Scripting
WordPress Core < 5.4.2 - Authenticated Stored Cross-Site Scripting
WordPress Core < 5.4.2 - Authenticated Stored Cross-Site Scripting
CSRF issue on preview pages in Bolt CMS
The filename of uploaded files vulnerable to stored XSS
Reflected XSS in GraphQL Playground
Events Manager <= 5.9.7.3 - Cross-Site Scripting
Events Manager <= 5.9.7.3 - Admin+ SQL Injection
SportsPress <= 2.7.1 - Cross-Site Scripting
Authorization Bypass Through User-Controlled Key in Opart Devis module (opartdevis)
Introspection in schema validation in Apollo Server
Use of insecure jQuery version in OctoberCMS
Regular Expression Denial of Service in websocket-extensions (NPM package)
dom4j allows External Entities by default which might enable XXE attacks
Signature wrapping vulnerability in Spring Security
Directory traversal attack in Spring Cloud Config
Directory traversal attack in Spring Cloud Config
File system access via H2 in Apache Ignite
Arbitrary shell command execution in logkitty
Improper validation of certificate with host mismatch in Apache Log4j SMTP appender
Elementor Website Builder <= 2.9.8 - Stored Cross-Site Scripting
Elementor Website Builder <= 2.9.8 - Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.