Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Incomplete cpp #include hardening in the Graphify Fortran extractor allows arbitrary host files to be read and exfiltrated into the knowledge graph when indexing an untrusted repository.
An unauthenticated remote code execution vulnerability in Mercury allows network clients to execute arbitrary Python code as the server process user on default deployments due to anonymous access to kernel endpoints.
LoopX serve-status uses an overly permissive CORS policy with wildcard headers on unauthenticated loopback read endpoints. This allows malicious websites visited by the operator to exfiltrate control-plane state and private Markdown files from registered goal repositories without user interaction.
An integer overflow in JavaCV's IP camera frame grabber can cause an infinite loop during buffer expansion when handling untrusted MJPEG HTTP streams. A malicious or modified response header can force the frame-grabbing thread into continuous 100% CPU utilization, resulting in a denial of service.
An argument injection vulnerability in the Claude Agent SDK for Python allows arbitrary command execution at CLI startup when an application passes untrusted input as a session ID. Users are advised to upgrade to the latest package version.
The DataStore Table UI in ckan-mcp-server does not validate inbound postMessage origins and targets a wildcard origin for outbound messages. This allows unauthorized frames to spoof content, disrupt handshakes, or observe outbound JSON-RPC messages.
Exposing Pipecat's development runner to untrusted networks allows unauthenticated callers to create bot sessions and paid Daily rooms. This can lead to unauthorized bot interactions, local resource exhaustion, and consumption of third-party service quotas.
A vulnerability in Claude Code allowed upstream repository maintainers to bypass hash pinning during plugin installation using specially named Git branches, leading to the installation of untrusted code. Users should update to the latest version.
A Qwik server in its default configuration can be crashed with a single unauthenticated HTTP request. Repeated requests can keep every server replica down.
A vulnerability in the ZIP extraction functionality of @appium/support allows arbitrary file writes via crafted symlinks pointing outside the extraction directory. An attacker supplying a malicious archive could overwrite files or potentially achieve code execution with the permissions of the running process.
A path traversal vulnerability in ClickMigrate allows an attacker who controls the migration name argument to create a file in an arbitrary writable location outside the intended migrations directory.
A denial-of-service vulnerability in tinytag allows malformed M4A files containing a zero-sized sub-atom to trigger an infinite loop during parsing.
A cache poisoning vulnerability in Nuxt OG Image allows unauthenticated attackers to modify image content delivered to users due to derivable cache keys on dynamic image routes.
An improper access control vulnerability in Backstage allows authenticated users to invoke backend actions that were excluded via configuration. Action permissions and downstream authorizations remain enforced.
In OpenNext Cloudflare, enabled cache interception can evaluate encoded paths inconsistently, allowing attackers to bypass authorization middleware and retrieve cached route content.
An unauthenticated reflected cross-site scripting vulnerability in TanStack Start allows attackers to execute arbitrary JavaScript in the victim's browser context by tricking them into opening a crafted URL. Affected packages should be upgraded to their patched releases.
A denial-of-service vulnerability in Microsoft.OpenApi.YamlReader and Microsoft.OpenApi.Readers allows crafted YAML OpenAPI documents with nested anchors and aliases to cause excessive memory consumption and crash the parsing process.
Metalama on Linux and macOS trusts files in shared temporary directories without integrity checks, allowing local users to execute arbitrary code with the privileges of other users running builds.
Apprise HTTP notification plugins and loaders follow redirects by default while re-sending configured authentication headers. If a configured destination is compromised or subjected to a man-in-the-middle attack, secrets can be leaked to an arbitrary cross-origin host.
A security feature bypass vulnerability in ASP.NET Core Kestrel allows aborted connections to reparse unread request-body bytes as new requests. This can lead to HTTP request smuggling or desynchronization attacks.
An information disclosure vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF) affects .NET applications on Windows. Applications using vulnerable runtime packages may expose sensitive information through unsafe XAML and XPS operations.
A vulnerability in Microsoft WindowsDesktop App Runtime (WPF) can lead to information disclosure through improper origin validation. Developers should update affected packages and .NET installations to mitigate the issue.
A vulnerability in .NET Core App Runtime and System.Private.CoreLib on Linux and macOS allows local attackers to manipulate Unix named-mutex and shared-memory paths to overwrite files, widen permissions, or elevate privileges.
A vulnerability in System.Net.Http allows SocketsHttpHandler to retain proxy authorization headers during an HTTP redirect. This can lead to information disclosure by leaking basic proxy credentials to the destination server.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.