High
CVE-2023-6196
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,538
Critical
CVE-2023-6014
MLflow authentication requirement bypass can allow a user to arbitrarily create an account
High
CVE-2023-48222
Authenticated Rundeck users can view or delete jobs they do not have authorization for.
Medium
CVE-2023-47112
Authenticated users can view job names and groups they do not have authorization to view
Critical
CVE-2023-6038
H2O local file inclusion vulnerability
Critical
CVE-2023-6015
MLflow allowed arbitrary files to be PUT onto the server
Critical
CVE-2023-6018
Remote Code Execution due to Full Controled File Write in mlflow
High
CVE-2023-48054
Missing SSL certificate validation in localstack v2.3.2 allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack.
High
CVE-2023-48056
PyPinkSign v0.5.1 uses a non-random or static IV for Cipher Block Chaining (CBC) mode in AES encryption. This vulnerability can lead to the disclosure of information and communications.
High
CVE-2023-48052
HTTPie allows attackers to eavesdrop on communications between the host and server via a man-in-the-middle attack
High
ghsa-54xq-cgqr-rpm3
sharp vulnerability in libwebp dependency CVE-2023-4863
High
CVE-2023-26031
Apache Hadoop allows local user to gain root privileges
Medium
CVE-2023-47836
WP Meta and Date Remover <= 2.3.0 - Cross-Site Request Forgery via updateSettings
Medium
CVE-2023-47835
ARI Stream Quiz <= 1.2.32 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2023-47788
Jetpack <= 12.6.2 - Improper Authorization via WPCom External Media REST endpoints
Medium
CVE-2023-47831
DrawIt (draw.io) <= 1.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2023-5605
URL Shortify <= 1.7.9 - Authenticated (Admin+) Stored Cross-Site Scripting
Medium
CVE-2023-47828
wpMandrill <= 1.33 - Missing Authorization via getAjaxStats
Medium
CVE-2023-47833
Theater for WordPress <= 0.18.3 - Authenticated (Administrator+) Stored Cross-Site Scripting via settings
Low
CVE-2023-47826
Restaurant & Cafe Addon for Elementor <= 1.5.3 - Missing Authorization via multiple AJAX functions
Medium
CVE-2023-47837
ARMember <= 4.0.10 - Authenticated (Subscriber+) Membership Plan Bypass
Medium
CVE-2023-47819
Easy Call Now by ThikShare <= 1.1.0 - Cross-Site Request Forgery via settings_page
Medium
CVE-2023-47774
Jetpack < 12.7 - Authenticated(Contributor+) Clickjacking via Iframe Injection
Medium
CVE-2023-47830
Live Preview for Contact Form 7 <= 1.2.0 - Missing Authorization via update_option
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.