Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Default trust stores in affected uv versions trust a root CA with compromised intermediate CA keys. An attacker with access to these compromised keys could forge certificates for arbitrary hostnames, allowing man-in-the-middle attacks on TLS traffic.
Certain certifi releases bundled a root certificate with compromised intermediate keys. An attacker on the network path could issue forged certificates for any hostname and intercept or modify TLS connections.
Incomplete cpp #include hardening in the Graphify Fortran extractor allows arbitrary host files to be read and exfiltrated into the knowledge graph when indexing an untrusted repository.
An unauthenticated remote code execution vulnerability in Mercury allows network clients to execute arbitrary Python code as the server process user on default deployments due to anonymous access to kernel endpoints.
Apprise HTTP notification plugins and loaders follow redirects by default while re-sending configured authentication headers. If a configured destination is compromised or subjected to a man-in-the-middle attack, secrets can be leaked to an arbitrary cross-origin host.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.