Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,120
Reset filtersImageSharp: HistogramEqualization uses an unvalidated luminance as an unchecked histogram index
ImageSharp: ICC CLUT parsing allocates from unvalidated channel and grid dimensions
ImageSharp: Tiled fax TIFF: tile buffer sized by TileWidth but fax decompressor writes scanlines of ImageWidth — heap OOB write
ImageSharp: CCITT fax decompression (T4/Modified Huffman): unbounded WriteBits overflows strip buffer — heap OOB write in SixLabors.ImageSharp
Kiota: Unsafe oauth_card_path references in Kiota-generated API plugin manifests
Kiota: Code injection through doc-comment delimiter reformation in Kiota Java and PHP generators
MsQuic: Improper Certificate Validation in Microsoft.Native.Quic.MsQuic.OpenSSL
CliInvoke.Specializations has command injection in PowerShell and Cmd shell wrappers
CliInvoke: Argument Injection in Extensibility Runner Factory
MPXJ: Potential Path Traversal Vulnerability in Primavera P3 PRX and SureTrak STX readers
MPXJ: XXE Vulnerability in MerlinReader
Steeltoe: Header-forwarded client cert lacks proof of private-key possession
Steeltoe.Discovery.Consul: malformed 'secure' metadata aborts service instance lookup (DoS)
Steeltoe.Discovery.Eureka: malformed enum/bool/timestamp field aborts entire registry fetch (DoS)
Steeltoe.Management.Endpoint: HttpExchanges URI masking leaks query-string secrets
SSH.NET: ScpClient allows server-side RCE via default SCP path handling
Umbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion
Marten's LINQ provider has SQL injection via unescaped string literals
OpenTelemetry.Resources.Host vulnerable to arbitrary code execution via local PATH hijacking on macOS
Microsoft Security Advisory CVE-2026-69304 – ASP.NET Core Denial of Service Vulnerability
Microsoft Security Advisory CVE-2026-69522 – .NET and Visual Studio Remote Code Execution Vulnerability
Microsoft Security Advisory CVE-2026-69439 – .NET and Visual Studio Elevation of Privilege Vulnerability
Microsoft Security Advisory CVE-2026-71328 – .NET and Visual Studio Remote Code Execution Vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.