Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,593
ps_checkout allows unauthorized method invocation through unvalidated parameter
Temporary Login <= 1.0.0 - Authentication Bypass to Account Takeover
Sentry's improper authentication on SAML SSO process allows user identity linking
OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter
Shopizer is vulnerable to Cross-site Scripting
Shopizer has a path traversal issue
Krayin CRM allows a remote attacker to execute arbitrary code via compose email function
Clerk has an authorization bypass when combining organization, billing, or reverification checks
n8n-mcp's IPv4-mapped IPv6 addresses bypass SSRF protection in validateUrlSync(), enabling full SSRF for SDK embedders
Jupyter Notebook Vulnerable to Authentication Token Theft via CommandLinker XSS
Freemius <= 2.10.1 - Reflected DOM-Based Cross-Site Scripting via url Parameter
Keycloak has a Forced Browsing issue
apache-airflow-providers-smtp: No certificate validation on SMTP STARTTLS connections in SMTP provider
mcp-server-semgrep has a Command Injection issue
Total Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation
JetEngine <= 3.8.8.1 - Unauthenticated SQL Injection
Ultimate Dashboard <= 3.8.14 - Cross-Site Request Forgery to Module Activation/Deactivation
WP Editor <= 1.2.9.2 - Cross-Site Request Forgery to Remote Code Execution via Plugin and Theme File Editor
Elementor Website Builder <= 4.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via REST API
Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool
i18next-http-middleware has path traversal / SSRF via user-controlled language and namespace parameters
Marked Vulnerable to OOM Denial of Service via Infinite Recursion in marked Tokenizer
Admidio: OIDC Token Introspection Endpoint Returns Active for All Tokens Without Validation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.