Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,405
ColorMag <= 3.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Display Name
WP Compress – Image Optimizer <= 6.11.08 - Missing Authorization to Unauthenticated CDN Modification
Memberpress <= 1.11.24 - Reflected Cross-Site Scripting via message and error
LiquidPoll – Polls, Surveys, NPS and Feedback Reviews <= 3.3.76 - Information Exposure
Rank Math SEO with AI SEO Tools <= 1.0.214 - Authenticated(Contributor+) Stored Cross-Site Scripting via HowTo block attributes
Getwid – Gutenberg Blocks <= 2.0.5 - Authenticated(Contributor+) Stored Cross-Site Scripting via Block Content
AI Post Generator | AutoWriter <= 3.3 - Missing Authorization
Network Summary <= 2.0.11 - Unauthenticated SQL Injection
360 Javascript Viewer <= 1.7.12 - Missing Authorization to Plugin Settings Update
Ibexa Kernel's files with blacklisted extensions can be still saved to drafts
Ibexa Kernel's files with blacklisted extensions can be still saved to drafts
Umbraco possible user enumeration
Dynamic Variable Evaluation in qiskit-ibm-runtime
Improper Authentication in Spring Authorization Server
Jupyter Server Proxy allows users to run arbitrary external processes alongside their Jupyter notebook servers and provides authenticated web access. Prior to versions 3.2.3 and 4.1.1, Jupyter Server
GeoServer's GWC Demos Page vulnerable to Stored Cross-Site Scripting (XSS)
GeoServer's MapML HTML Page vulnerable to Stored Cross-Site Scripting (XSS)
GeoServer's WMS OpenLayers Format vulnerable to Stored Cross-Site Scripting (XSS)
GeoServer's GWC Seed Form vulnerable to Stored Cross-Site Scripting (XSS)
GeoServer's Simple SVG Renderer vulnerable to Stored Cross-Site Scripting (XSS)
GeoServer's Style Publisher vulnerable to Stored Cross-Site Scripting (XSS)
GeoServer Arbitrary file renaming vulnerability in REST Coverage/Data Store API
Stored Cross-Site Scripting (XSS) vulnerability in GeoServer's REST Resources API
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.