Understand vulnerabilities.
Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Missing origin validation in Storybook preview allows a malicious website to trigger unauthorized file modifications on a running development server. Under specific conditions with user interaction, this could lead to arbitrary code execution on the developer's machine.
An issue in Electron causes HID and USB permission checks from an iframe to receive the top-level frame's origin and details. Applications relying on origin-based logic may grant embedded frames access intended only for the top-level page.
In ApostropheCMS prior to 4.34.0, a REST endpoint bypasses page and field access controls, allowing editor-level users to view restricted pages and fields if they know the document identifier.
A missing authentication check in ApostropheCMS allows unauthenticated users with a standard CSRF cookie to trigger cleanup operations and delete temporary export files, as well as modify job records in the database.
A vulnerability in ApostropheCMS allows any authenticated user to enumerate slugs across the system via the doc/slugTaken endpoint, exposing the existence of private, draft, and administrative content.
ApostropheCMS contains a stored cross-site scripting vulnerability where editor-controlled style field values in widgets are serialized into HTML wrapper attributes without escaping, allowing arbitrary script execution.
A stored cross-site scripting vulnerability in ApostropheCMS allows authenticated users with edit permissions to inject arbitrary HTML and JavaScript via trailing content in color fields. Upgrading to version 4.34.0 or later mitigates this issue.
A vulnerability in ApostropheCMS allows the import API to bypass publication roles, enabling users with edit-only permissions to create, replace, or delete published content without required publishing authority.
A vulnerability in ApostropheCMS allows authenticated users to exhaust server storage during archive extraction due to missing decompression quotas and failure cleanup, potentially causing a denial of service.
In @apostrophecms/import-export, the overrideDuplicates continuation accepts client-supplied replacement choices, allowing contributors to overwrite published content without publication authority.
A vulnerability in Vite allows cross-origin script execution when a development server passes an unmodified request URL to custom middleware. An attacker can direct a user to a malicious site that executes arbitrary scripts within the context of the development server page.
In Vite dev servers running on Node.js or Deno, specially crafted requests can disclose the initial bytes of arbitrary files outside the configured access boundaries through WebAssembly parser error messages.
An unauthenticated resource exhaustion vulnerability in ApostropheCMS allows remote attackers to trigger large chunked upload processing and cleanup operations without authentication, potentially leading to denial of service.
A denial-of-service vulnerability in markdown-it allows remote attackers to block the Node.js event loop via crafted multi-line link reference definitions. Processing unclosed definitions causes quadratic execution time under default configurations.
A URL parsing discrepancy in the Angular HTTP client can cause cross-site request forgery tokens to leak to external domains during mutating requests. Attackers can leverage these leaked tokens to execute unauthorized actions against an authenticated user session.
In affected versions of the MCP TypeScript SDK, an unauthenticated HTTP request within default size limits can exhaust server memory during validation. This allows attackers to crash the server process through denial of service.
When HTML is enabled in markdown-it, parsing repeated unterminated HTML constructs takes quadratic time. This allows crafted input to block the Node.js event loop and lead to denial of service.
A vulnerability in the MCP TypeScript server SDK causes messages and notifications to be delivered to the wrong HTTP client when server or transport instances are shared, leading to data exposure.
In affected versions of MCP TypeScript SDK, experimental tasks were not bound to the session that created them. Clients sharing a handler could list, read, and cancel each other's tasks.
ApostropheCMS notification endpoints fail to verify authentication or ownership. An unauthenticated attacker who obtains a valid notification ID can modify or permanently delete another user's notifications.
Under Windows, launch-editor does not properly escape percent signs, allowing potential command execution if an attacker can manipulate filenames, environment variables, or NTFS streams.
A vulnerability in ApostropheCMS allows the general public to access user objects through relationships if templates expose them, as viewRole is not enforced for unauthenticated public users.
An authorization bypass in the ApostropheCMS page REST API allows unauthenticated visitors and low-privileged contributors to read restricted page content and site structure metadata.
A substring check in ApostropheCMS import-export tar extraction fails to catch relative directory traversal paths, allowing authenticated users to crash the Node process.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.
Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.
A daily digest of new vulnerabilities, critical ones included.
Notifications about important updates.
Practical advice on application security and monitoring.
Type at least two characters to see suggestions.
/opens search↑↓pick a resultEntergo to the resultESCcloses
We respect your privacy
We use cookies to keep the site working and to learn what to improve on it. Without your consent only the essentials run. You can change your choice at any time from the footer.
Read the privacy policy
Cookie settings
Decide what you agree to. Required cookies are always on - without them the site could not even remember this choice.
Read the privacy policy
Always on
Your session, form protection and the memory of this very choice. The site does not work without them, so they cannot be turned off.
Remembering your language, theme and accessibility settings so you do not have to pick them on every visit.
Anonymous visit statistics: which pages get read and where people get lost. This is what we improve the site on.
Measuring how well our ads work and matching them to your interests on external services.
