Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
An improper access control vulnerability in Backstage allows authenticated users to invoke backend actions that were excluded via configuration. Action permissions and downstream authorizations remain enforced.
In OpenNext Cloudflare, enabled cache interception can evaluate encoded paths inconsistently, allowing attackers to bypass authorization middleware and retrieve cached route content.
An unauthenticated reflected cross-site scripting vulnerability in TanStack Start allows attackers to execute arbitrary JavaScript in the victim's browser context by tricking them into opening a crafted URL. Affected packages should be upgraded to their patched releases.
A code injection vulnerability in TinaCMS CLI allows arbitrary JavaScript execution during project builds when an unescaped Git branch name is embedded directly into generated client source files.
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment. If an authenticated editor opens a crafted link, an unauthenticated remote attacker can gain arbitrary read and write access to the site's content API as that editor.
A stored cross-site scripting vulnerability in @tinacms/web-components allows attackers with content editing privileges to execute arbitrary scripts via unvalidated link URL schemes in rich-text content.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.