Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Broken Link Checker <= 2.2.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Doofinder for WooCommerce <= 2.1.8 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
PB oEmbed HTML5 Audio <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via shortcode
Denial of Service in Connect2id Nimbus JOSE+JWT
Ghost has possible Cross-site Scripting issue
My Calendar <= 3.4.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
My Calendar <= 3.4.23 - Authenticated (Admin+) Stored Cross-Site Scripting via Events
angular vulnerable to super-linear runtime due to backtracking
Geo Controller <= 8.6.4 - Unauthenticated PHP Object Injection via shortcode REST API Route
NoneBot Potential Information Leak in User-Constructed Message Templates
Concrete CMS vulnerable to stored XSS via the Role Name field
Concrete CMS vulnerable to reflected XSS via the Image URL Import Feature
Concrete CMS vulnerable to stored XSS in file tags and description attributes
Apache Solr's Streaming Expressions allow users to extract data from other Solr Clouds
Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets
Apache Solr can leak certain passwords due to System Property redaction logic inconsistencies
Apache Solr Schema Designer blindly "trusts" all configsets
commonground-api-common unexploitable privilege escalation in JWT authentication middleware
Pkg Local Privilege Escalation
Micronaut management endpoints vulnerable to drive-by localhost attack
Cross-site scripting (XSS) vulnerability in Grav
October CMS Cross-site Scripting vulnerability
DIRAC's TokenManager does not check permissions on cached tokens
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.