Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,458
Reset filtersGhost: Remote Code Execution via Bookmark Card Images
Ghost: Stored XSS via Embed Card Previews
Ghost : Stored XSS via SVG Files in Content Imports
Ghost: Regular Expression Denial of Service in External Media Inliner
Ghost: Regular Expression Denial of Service in Content Import
Ghost: Server-Side Request Forgery in Bookmark Fetching
Ghost: Private IP Filtering Bypass via IPv6 Transition Addresses
Ghost: Stored XSS via SVG Uploads Bypassing Sanitization
Next.js: Pending `use cache` fill can leak Draft Mode content into regular responses and persisted pages
Next.js has cache poisoning of SSG and ISR pages in self-hosted applications
Next.js has information disclosure in development server's Model Context Protocol endpoint
Next.js has information disclosure in App Router metadata image routes via dynamicParams bypass
Next.js has cache poisoning in SSG/ISR rendering that leads to cross-user content substitution and persistent denial of service
Next.js has Server-Side Request Forgery in Image Optimization
Payload: SQL injection in SQLite/Postgres
Payload: Remote Code Execution through first-register
Payload has a tenant authorization bypass in Multi-Tenant Plugin
Payload external upload trust validation issue
Payload: Bypassed sanitization of user uploaded SVGs
@payloadcms/plugin-multi-tenant has a cross-tenant create issue
Payload: Incomplete validation during the upload file lifecycle
Payload: Unauthenticated account-lockout denial of service
Payload: Client uploads could overwrite S3 objects
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.