Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Account Takeover Through Password Reset Poisoning
Cross-site Scripting in Backdrop CMS
Cross-site Scripting in Backdrop CMS
OS Command Injection in Apache Airflow
OS Command Injection in Apache Airflow
OS Command Injection in Apache Airflow
OS Command Injection in Apache Airflow
CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser account
ToolJet is vulnerable to Denial of Service (DoS)
Remote code execution vulnerability in dependency System.Drawing.Common
Tensorflow vulnerable to Out-of-Bounds Read
Stored XSS in Compare Mode
Blind SQL Injection via GridFieldSortableHeader
Videojs HTML5 Player <= 1.1.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
All In One WP Security & Firewall <= 5.1.0 - Cross-Site Request Forgery
Yith WooCommerce Gift Cards Premium <= 3.19.0 - Unauthenticated Arbitrary File Upload
Checkout for PayPal <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
WP Stripe Checkout <= 1.2.2.20 - Authenticated (Contributor+) Stored Cross-Site Scripting
Easy Video Player <= 1.2.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Responsive Lightbox2 <= 1.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Flowerplayer Video Player <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
SMSA Shipping for WooCommerce <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Download
Reflected XSS in querystring parameters
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.