Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 61
Reset filtersDOMPurify: Prototype Pollution to XSS Bypass via CUSTOM_ELEMENT_HANDLING Fallback
DOMPurify's ADD_TAGS function form bypasses FORBID_TAGS due to short-circuit evaluation
DOMPurify ADD_ATTR predicate skips URI validation
DOMPurify USE_PROFILES prototype pollution allows event handlers
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController)
DOMPurify is vulnerable to mutation-XSS via Re-Contextualization
Cross-Site Scripting (XSS) via SVG Schema innerHTML Injection in @pdfme/schemas
OneUptime: Stored XSS via Mermaid Diagram Rendering (securityLevel: "loose")
Trix has a Stored XSS vulnerability through serialized attributes
NocoDB Vulnerable to Stored Cross-Site Scripting via Rich Text Cells
NocoDB Vulnerable to Stored Cross-site Scripting via Comments
NocoDB Vulnerable to Stored Cross-Site Scripting via Comments and Rich Text Cells
DOMPurify contains a Cross-site Scripting vulnerability
DOMPurify contains a Cross-site Scripting vulnerability
html2pdf.js contains a cross-site scripting vulnerability
Malicious website can execute commands on the local system through XSS in the OpenCode web UI
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering
DOMPurify allows Cross-site Scripting (XSS)
Trix editor subject to XSS vulnerabilities on copy & paste
DOMPurify vulnerable to tampering by prototype polution
Prototype pollution vulnerability found in Mermaid's bundled version of DOMPurify
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.