High
CVE-2024-24558
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 537
Reset filters
High
CVE-2024-23641
Sending a GET or HEAD request with a body crashes SvelteKit
Critical
CVE-2024-22206
@clerk/nextjs auth() and getAuth() methods vulnerable to insecure direct object reference (IDOR)
Medium
CVE-2023-50710
Named path parameters can be overridden in TrieRouter
Medium
CVE-2023-48309
Possible user mocking that bypasses basic authentication
Medium
CVE-2023-48223
JWT Algorithm Confusion
High
CVE-2023-48238
json-web-token library is vulnerable to a JWT algorithm confusion attack
Medium
CVE-2023-46729
Sentry Next.js vulnerable to SSRF via Next.js SDK tunnel endpoint
High
CVE-2023-45827
Prototype Pollution(PP) vulnerability in setByPath
Low
CVE-2023-46298
Next.js missing cache-control header may lead to CDN caching empty reply
High
CVE-2023-46115
Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables
High
CVE-2023-38507
Strapi Improper Rate Limiting vulnerability
Medium
CVE-2023-26140
@excalidraw/excalidraw Cross-site Scripting vulnerability
Medium
CVE-2023-34093
Making all attributes on a content-type public without noticing it
Critical
CVE-2023-30846
Potential leak of authentication data to 3rd parties
High
CVE-2023-29003
SvelteKit vulnerable to Cross-Site Request Forgery
High
CVE-2023-27490
Missing proper state, nonce and PKCE checks for OAuth authentication
Critical
CVE-2022-39353
xmldom allows multiple root nodes in a DOM
High
CVE-2022-40277
Joplin Remote Code Execution
Medium
CVE-2022-39263
Upstash Adapter missing token verification
Medium
CVE-2022-36046
Next.js is a React framework that can provide building blocks to create web applications. All of the following must be true to be affected by this CVE: Next.js version 12.2.3, Node.js version above v1
Low
ghsa-56x4-j7p9-fcf9
Command Injection in moment-timezone
Critical
CVE-2022-36010
React Editable Json Tree vulnerable to arbitrary code execution via function parsing
Low
CVE-2022-31186
next-auth before v4.10.2 and v3.29.9 leaks excessive information into log
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.