Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 529
Reset filtersTinyMCE Cross-Site Scripting (XSS) vulnerability using through data-mce- prefixed src, href, style attributes
TinyMCE Cross-Site Scripting (XSS) vulnerability using sanitization bypass through nested SVGs
Nerdbank.MessagePack has a memory amplification DoS in collection deserialization
Umbraco.Cms: Open Redirect Vulnerability in Surface Controllers
OpenMcdf: Uncatchable infinite loop in DirectoryTree.TryGetDirectoryEntry on crafted CFB directory cycle
Scriban: array.insert_at index parameter DoS bypasses LoopLimit and LimitToString
ImageMagick: Heap Buffer Over-Write of a single byte in the JP2 encoder.
Microsoft Security Advisory CVE-2026-35433 – .NET Elevation of Privilege Vulnerability
Microsoft Security Advisory CVE-2026-42899 – ASP.NET Core Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-32175 – .NET Core Tampering Vulnerability
Marten has an injection vulnerability in its full-text search regConfig parameter
oxidize-pdf: NaN/inf bypass in colour content-stream emission causes PDF rejection (DoS)
SharpCompress has directory traversal via directory entries in WriteToDirectory (zip slip variant)
OpenTelemetry.Exporter.Instana bypasses TLS certificate validation when a proxy is configured
Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException
Snappier has an infinite loop during SnappyStream decompression with malformed framed input
OpAMP client reads unbounded HTTP response bodies
YAFNET has Stored XSS in Forum Thread Posts/Replies that Allows Arbitrary JavaScript Execution for All Thread Viewers
YAFNET: Pre-Handler Authorization Bypass on Admin Pages Enables Blind SQL Execution via `/Admin/RunSql`
YAFNET has Unauthenticated Stored Second-Order XSS in Admin Event Log via Reflected `User-Agent` Header
OpenTelemetry's disk retry default temp path enables local blob injection via OTLP Exporter
OneCollector exporter reads unbounded HTTP response bodies
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.