Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filtersOpening a malicious website while running a Nuxt dev server could allow read-only access to code
Opening a malicious website while running a Nuxt dev server could allow read-only access to code
NodeBB Cross-site scripting (XSS) vulnerability
Cross Site Scripting vulnerability in store2
Directus has a DOM-Based cross-site scripting (XSS) via layout_options
Directus allows privilege escalation using Share feature
Unlimited consumption of resources in @fastify/multipart
MathLive's Lack of Escaping of HTML allows for XSS
Use of Insufficiently Random Values in undici
XSS/HTML Injection Vulnerability in Umbraco Backoffice Components
Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify
Websites were able to send any requests to the development server and read the response in vite
KaTeX \htmlData does not validate attribute names
AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider
Eugeny Tabby Sends Password Despite Host Key Verification Failure
parse-uri Regular expression Denial of Service (ReDoS)
Mongoose search injection vulnerability
Lodestar snappy checksum issue
Lodestar snappy decompression issue
Next.js Allows a Denial of Service (DoS) with Server Actions
Trix allows Cross-site Scripting via `javascript:` url in a link
path-sanitizer allows bypassing the existing filters to achieve path-traversal vulnerability
Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.