Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filtersts-fns has prototype pollution vulnerability
messageformat has a prototype pollution vulnerability
web3-core-subscriptions has a Prototype Pollution vulnerability
Mastra Docs MCP Server `@mastra/mcp-docs-server` Leads to Information Exposure
Command Injection in adb-mcp MCP Server
Claude Code Vulnerable to Arbitrary Code Execution via Plugin Autoloading with Specific Yarn Versions
tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball
counterpart vulnerable to prototype pollution
CSVTOJSON has a prototype pollution vulnerability
min-document vulnerable to prototype pollution
messageformat prototype pollution vulnerability
Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink
Mailgen: HTML injection vulnerability in plaintext e-mails
`git-comiters` Command Injection vulnerability
@conventional-changelog/git-client has Argument Injection vulnerability
Codex has sandbox bypass due to bug in path configuration logic
@digitalocean/do-markdownit has Type Confusion vulnerability
Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages
@sequa-ai/sequa-mcp has Command Injection vulnerability
Parcel has an Origin Validation Error vulnerability
Nuxt has Client-Side Path Traversal in Nuxt Island Payload Revival
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
@executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.