Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters@valtimo/components exposes access token to form.io
lobe-chat `/api/proxy` endpoint Server-Side Request Forgery vulnerability
thelounge may publicly disclose of all usernames/idents via port 113
Next.js Server-Side Request Forgery in Server Actions
Next.js Vulnerable to HTTP Request Smuggling
@cyclonedx/cyclonedx-library Improper Restriction of XML External Entity Reference vulnerability
Trix Editor Arbitrary Code Execution Vulnerability
react-pdf vulnerable to arbitrary JavaScript execution upon opening a malicious PDF with PDF.js
PDF.js < 4.2.67 - Arbitrary JavaScript Execution
kurwov vulnerable to Denial of Service due to improper data sanitization
Vditor allows Cross-site Scripting via an attribute of an `A` element
libxmljs2 vulnerable to type confusion when parsing specially crafted XML
libxmljs2 type confusion vulnerability when parsing specially crafted XML
libxmljs vulnerable to type confusion when parsing specially crafted XML
libxmljs vulnerable to type confusion when parsing specially crafted XML
Firebase vulnerable to CRSF attack
s3-url-parser vulnerable to Denial of Service via regexes component
xml-crypto vulnerable to XML signature verification bypass due improper verification of signature/signature spoofing
Uptime Kuma vulnerable to authenticated remote code execution via malicious plugin installation
Uptime Kuma's authenticated path traversal via plugin repository name may lead to unavailability or data loss
Flowise vulnerable to code injection via api/v1
ejs lacks certain pollution protection
Passbolt Browser Extension leaks password information
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.