Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
An overflow in aiohttp during Max-Age processing can prevent connections from closing properly, allowing an attacker to temporarily exhaust the connector pool until garbage collection runs.
In AIOHTTP, attackers sending absolute-form HTTP requests can spoof the request scheme. If an application relies on the scheme for security checks, attackers may bypass security logic by making unencrypted connections appear encrypted or vice versa.
A vulnerability in aiohttp allows a subdomain to remove the Host-Only flag from existing parent domain cookies, potentially weakening cookie scoping protections.
A denial-of-service vulnerability in markdown-it allows remote attackers to block the Node.js event loop via crafted multi-line link reference definitions. Processing unclosed definitions causes quadratic execution time under default configurations.
A URL parsing discrepancy in the Angular HTTP client can cause cross-site request forgery tokens to leak to external domains during mutating requests. Attackers can leverage these leaked tokens to execute unauthorized actions against an authenticated user session.
In affected versions of the MCP TypeScript SDK, an unauthenticated HTTP request within default size limits can exhaust server memory during validation. This allows attackers to crash the server process through denial of service.
When HTML is enabled in markdown-it, parsing repeated unterminated HTML constructs takes quadratic time. This allows crafted input to block the Node.js event loop and lead to denial of service.
A vulnerability in the MCP TypeScript server SDK causes messages and notifications to be delivered to the wrong HTTP client when server or transport instances are shared, leading to data exposure.
A vulnerability in launch-editor allows attackers to bypass file existence checks on Windows using a specially crafted path. When combined with argument escaping issues, this can lead to operating system command injection if an attacker controls the file path.
A vulnerability in the MCP TypeScript SDK allows servers using bearer authentication to accept tokens issued for other services when sharing an authorization server. Attackers could potentially reuse valid tokens across services to gain unauthorized access unless audience validation is explicitly configured.
The pure-Python parser in aiohttp is vulnerable to HTTP request smuggling when running without standard C extensions. Applications can resolve this issue by updating aiohttp or switching to the default C parser.
A vulnerability in AIOHTTP allows attackers to exhaust file descriptors using specially crafted multipart requests. This can lead to resource exhaustion and potential denial of service.
Default trust stores in affected uv versions trust a root CA with compromised intermediate CA keys. An attacker with access to these compromised keys could forge certificates for arbitrary hostnames, allowing man-in-the-middle attacks on TLS traffic.
Certain certifi releases bundled a root certificate with compromised intermediate keys. An attacker on the network path could issue forged certificates for any hostname and intercept or modify TLS connections.
In affected versions of MCP TypeScript SDK, experimental tasks were not bound to the session that created them. Clients sharing a handler could list, read, and cancel each other's tasks.
ApostropheCMS notification endpoints fail to verify authentication or ownership. An unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notifications.
Under Windows, launch-editor does not properly escape percent signs, allowing potential command execution if an attacker can manipulate filenames, environment variables, or NTFS streams.
In affected versions of the MCP TypeScript client SDK, HTTP client transports and OAuth requests followed cross-origin redirects, potentially exposing custom headers and request bodies to external hosts.
A vulnerability in ApostropheCMS allows the general public to access user objects through relationships if templates expose them, as viewRole is not enforced for unauthenticated public users.
An authorization bypass in the ApostropheCMS page REST API allows unauthenticated visitors and low-privileged contributors to read restricted page content and site structure metadata.
A substring check in ApostropheCMS import-export tar extraction fails to catch relative directory traversal paths, allowing authenticated users to crash the Node process.
A client-side prototype pollution vulnerability in ApostropheCMS allows attackers to execute arbitrary JavaScript in the context of an authenticated user session if the victim visits a crafted link, potentially leading to unauthorized data access and administrative compromise.
A lack of attempt throttling on ApostropheCMS's authenticated password-change endpoint allows attackers with an active session to repeatedly guess the current password without lockout or rate limiting, potentially enabling account takeover if the password is weak.
In ApostropheCMS before 4.33.0, the exist-in-locale API allows authenticated low-privilege users to determine whether restricted documents and drafts exist and retrieve localized identifiers without proper document-level authorization checks.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.