Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
UpdraftPlus 1.23.8 - 1.26.7 - Authenticated (Subscriber+) Information Exposure
Verify API <= 1.0.0 - Missing Authorization
Verge3D <= 4.13.0 - Unauthenticated Information Exposure
EmbedPress <= 4.6.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
NextScripts: Social Networks Auto-Poster <= 4.4.7 - Missing Authorization
WPeMatico RSS Feed Fetcher <= 2.8.26 - Authenticated (Contributor+) Stored Cross-Site Scripting
Verge3D 4.1.0 - 4.13.0 - Missing Authorization
Optima Express 8.5.0 - 8.7.5 - Missing Authorization
Malcure Malware Shield <= 19.9.6 - Missing Authorization
MasterStudy LMS 3.5.29 - 3.7.49 - Authenticated (Contributor+) Local File Inclusion
WPeMatico RSS Feed Fetcher <= 2.8.26 - Authenticated (Contributor+) Privilege Escalation
Optima Express 8.6.0 - 8.7.5 - Authenticated (Author+) Stored Cross-Site Scripting
Mailchimp for WooCommerce <= 6.2 - Unauthenticated Insecure Direct Object Reference
Contao: Server-Side Request Forgery (SSRF) via Unvalidated RSS Feed URL in Feed Reader Module
Cline: Cross-Origin WebSocket Hijacking in Cline Hub Dashboard (`/browser` endpoint)
zbateson/mail-mime-parser has CRLF header injection via attachment filename
zbateson/mail-mime-parser has uncontrolled resource consumption (CPU/memory DoS) parsing untrusted MIME
@rsdoctor/rspack-plugin has Unauthenticated HTTP API that Exposes Project Source Code and Build Metadata
@bytebase/dbhub's read-only mode does not prevent database writes
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
http4s-scala-xml has an XML External Entity (XXE) processing issue
xhtml-purifier has HTML attribute-injection (sanitizer bypass) that leads to XSS
`@bsv/wallet-toolbox` / `-client` / `-mobile` don't verify storage-supplied recipient output scripts against caller-requested outputs in createAction
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.