High
CVE-2024-40642
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,587
High
CVE-2024-6338
FV Player <= 7.5.46.7212 - Authenticated (Subscriber+) SQL Injection via exclude Parameter
Medium
CVE-2024-39900
The OpenSearch reporting plugin improperly controls tenancy access to reporting resources
High
CVE-2024-29178
Apache StreamPark: FreeMarker SSTI RCE Vulnerability
Medium
CVE-2024-5997
Duplica <= 0.6 - Authenticated (Subscriber+) Missing Authorization to Users/Posts Duplicates Creation
Medium
CVE-2024-6455
ElementsKit Elementor addons <= 3.2.0 - Unauthenticated Information Exposure via ekit_widgetarea_content Function
Medium
CVE-2024-6481
Search & Filter Pro <= 2.5.17 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2024-6799
YITH Essential Kit for WooCommerce #1 <= 2.34.0 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Install, Activation, and Deactivation
High
CVE-2023-52209
WPForms User Registration <= 2.1.0 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation
Medium
CVE-2024-5977
GiveWP – Donation Plugin and Fundraising Platform <= 3.13.0 - Insecure Direct Object Reference to Authenticated (GiveWP Worker+) Arbitrary Post Actions
Medium
CVE-2024-6884
Gutenberg Blocks by Kadence Blocks – Page Builder Features <= 3.2.38 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown
Medium
CVE-2024-39125
Roundup before 2.4.0 allows XSS via a SCRIPT element in an HTTP Referer header.
Medium
CVE-2024-39126
Roundup before 2.4.0 allows XSS via JavaScript in PDF, XML, and SVG documents.
Medium
CVE-2024-39124
In Roundup before 2.4.0, classhelpers (_generic.help.html) allow XSS.
Medium
CVE-2024-36694
openCart Server-Side Template Injection (SSTI) vulnerability
High
CVE-2024-3242
Brizy – Page Builder <= 2.4.44 - Authenticated (Contributor+) Arbitrary File Upload
Medium
ghsa-vhmj-5q9r-mm9g
BlastRADIUS also affects eduMFA
Medium
ghsa-52cw-pvq9-9m5v
Silverstripe uses TinyMCE which allows svg files linked in object tags
Low
CVE-2024-40636
Steeltoe Leaks Basic Auth Credentials to Logs After Fetch Registry Error
Medium
CVE-2024-29120
Apache StreamPark: Information leakage vulnerability
Medium
CVE-2024-6833
Zowe CLI allows storage of previously entered secure credentials in a plaintext file
Critical
CVE-2023-7272
Eclipse Parsson stack overflow when parsing deeply nested input
High
CVE-2024-40633
Sylius has a security vulnerability via adjustments API endpoint
Medium
CVE-2024-32981
Silverstripe Framework has a Cross-site Scripting vulnerability with encoded payload
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.