Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
An out-of-bounds read vulnerability in Pillow allows certain decoders to read heap memory past the end of a buffer when processing specific image dimensions. This may disclose adjacent memory into decoded pixel data or cause an application crash.
Applying rank, median, minimum, or maximum filters to zero-width or zero-height images in Pillow triggers a NULL pointer dereference in ImagingExpand, causing Python worker processes to crash and enabling denial of service.
Pillow lacks sanitization when constructing Ghostscript commands from input filenames, permitting command-line argument injection that can be escalated to remote code execution.
An attacker can trigger an infinite loop in pypdf by supplying a crafted, incomplete PDF file that terminates inside the xref table.
A vulnerability in aiohttp allows a subdomain to remove the Host-Only flag from existing parent domain cookies, potentially weakening cookie scoping protections.
A vulnerability in JupyterLab allows a command link trust prompt to mark a currently active document as trusted instead of the clicked one, potentially allowing buttons in untrusted documents to execute without confirmation.
Incomplete cpp #include hardening in the Graphify Fortran extractor allows arbitrary host files to be read and exfiltrated into the knowledge graph when indexing an untrusted repository.
An unauthenticated remote code execution vulnerability in Mercury allows network clients to execute arbitrary Python code as the server process user on default deployments due to anonymous access to kernel endpoints.
LoopX serve-status uses an overly permissive CORS policy with wildcard headers on unauthenticated loopback read endpoints. This allows malicious websites visited by the operator to exfiltrate control-plane state and private Markdown files from registered goal repositories without user interaction.
An authorization bypass in pacioli's document-layer consent gate allows nested operations to cancel caller-specified pre-existing documents without human consent markers or denial audit entries.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.