High
CVE-2023-46446
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 733
Reset filters
Medium
CVE-2023-46445
AsyncSSH Rogue Extension Negotiation
High
CVE-2023-47117
Label Studio Object Relational Mapper Leak Vulnerability in Filtering Task
Medium
ghsa-8c6x-g4fw-8rf4
Whatsapp-Chat-Exporter has Cross-Site Scripting vulnerability in HTML output of chats.
Critical
ghsa-hj8m-9fhf-v7jp
fief-server Server-Side Template Injection vulnerability
High
CVE-2023-34233
Snowflake Python Connector vulnerable to Command Injection
High
ghsa-cpmr-mw4j-99r7
Nginx alias path traversal allows unauthenticated attackers to read all files on /label_studio/core/
Medium
CVE-2023-27494
Streamlit publishes previously-patched Cross-site Scripting vulnerability
High
CVE-2023-27476
OWSLib vulnerable to XML External Entity (XXE) Injection
Medium
CVE-2023-24769
Changedetection.io before v0.40.1.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the main page. This vulnerability allows attackers to execute arbitrary web scripts o
Medium
CVE-2023-0591
ubireader_extract_files is vulnerable to path traversal when run against specifically crafted UBIFS files, allowing the attacker to overwrite files outside of the extraction directory (provided the pr
Medium
CVE-2022-31777
A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote attackers to execute arbitrary JavaScript in the web browser of a user, by including a mal
Medium
CVE-2021-32862
nbconvert vulnerable to cross-site scripting (XSS) via multiple exploit paths
High
CVE-2022-29241
Jupyter server Token bruteforcing
Medium
CVE-2021-3313
Plone CMS until version 5.2.4 has a stored Cross-Site Scripting (XSS) vulnerability in the user fullname property and the file upload functionality. The user's input data is not properly encoded when
Critical
CVE-2020-22083
** DISPUTED ** jsonpickle through 1.4.1 allows remote code execution during deserialization of a malicious payload through the decode() function. Note: It has been argued that this is expected and cle
High
CVE-2022-1432
Cross-site Scripting in OctoPrint
Critical
CVE-2022-28347
SQL Injection in Django
Critical
CVE-2022-0766
Server-Side Request Forgery in calibreweb
High
CVE-2022-21668
Pipenv's requirements.txt parsing allows malicious index url in comments
Medium
CVE-2021-43837
vault-cli contains possible RCE when reading user-defined data
Medium
CVE-2021-25986
Cross-site Scripting in django-wiki
High
CVE-2021-25962
CSV injection in shuup
High
CVE-2021-37678
Arbitrary code execution due to YAML deserialization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.