Medium
CVE-2024-39001
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 561
Reset filters
High
CVE-2024-38996
Prototype pollution in ag-grid-community via the _.mergeDeep function
High
CVE-2024-34065
@strapi/plugin-users-permissions leaks 3rd party authentication tokens and authentication bypass
High
CVE-2024-34350
Next.js Vulnerable to HTTP Request Smuggling
Medium
CVE-2024-4367
PDF.js < 4.2.67 - Arbitrary JavaScript Execution
High
CVE-2024-26135
MeshCentral cross-site websocket hijacking (CSWSH) vulnerability
Medium
CVE-2024-23725
Cross-site Scripting in Ghost
Medium
CVE-2023-51701
@fastify/reply-from JSON Content-Type parsing confusion
Medium
CVE-2023-26159
Follow Redirects improperly handles URLs in the url.parse() function
Medium
ghsa-hfxh-rjv7-2369
Uptime Kuma Authenticated remote code execution via TailscalePing
Medium
ghsa-wm63-7627-ch33
@vendure/core's insecure currencyCode handling allows wrong payment amounts
Medium
CVE-2021-43849
cordova-plugin-fingerprint-aio DoS vulnerability
High
CVE-2023-40185
Shescape on Windows escaping may be bypassed in threaded context
Low
CVE-2023-35931
Shescape potential environment variable exposure on Windows with CMD
High
ghsa-xv3q-jrmm-4fxv
Authentication Bypass in @strapi/plugin-users-permissions
Medium
ghsa-8r69-3cvp-wxc3
Batched HTTP requests may set incorrect `cache-control` response header
High
CVE-2022-25918
Inefficient Regular Expression Complexity in shescape
Low
CVE-2022-37599
loader-utils (JS package) < 3.2.1 - Regular Expression Denial of Service
Medium
CVE-2022-3224
parse-url parses http URLs incorrectly, making it vulnerable to host name spoofing
Medium
ghsa-2fvv-qxrq-7jq6
apollo-server-core vulnerable to URL-based XSS attack affecting IE11 on default landing page
Critical
CVE-2022-35942
loopback-connector-postgresql Vulnerable to Improper Sanitization of `contains` Filter
Medium
CVE-2022-25869
Angular (deprecated package) Cross-site Scripting
Critical
CVE-2022-31180
Shescape vulnerable to insufficient escaping of whitespace
High
CVE-2020-1915
Out-of-bounds Read in Facebook Hermes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.