Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter
CrateDB's Blob HTTP handler bypasses authorization
Kimai Password Reset Link Remains Valid After Password Change
Malicious code in nucbox (PyPI)
Malicious code in napari-ufish (PyPI)
repomix: attach_packed_output can bypass file-read secret scanning for supported local files
repomix Vulnerable to Command Injection (RCE) via `--remote-branch` Argument Injection
Twig: Sandbox filter, tag and function allow-list bypass when sandbox state changes between renders for a cached `Template`
Schema.org has cross-site scripting (XSS) via script break-out in toScript() output
Apache HttpComponents Core: HPackDecoder Unlimited Header List Size Before SETTINGS ACK
Apache HttpComponents Core HTTP/1 header parsing can cause memory-exhaustion denial of service
wetty vulnerable to DOM XSS via file-download filename
EasyAdminBundle has path traversal and reflected XSS in Flag and Icon Twig components
auth-fetch-mcp has SSRF Protection Bypass via IPv4-mapped IPv6 Loopback
@jshookmcp/jshook: ICMP probe and traceroute skip local-network SSRF authorization
GeoNetwork has ACL bypass on Elasticsearch search when request body omits query field
GeoNetwork has reflected XSS through client-side template injection
Image Optimizer <= 1.7.4 - Authenticated (Author+) Arbitrary File Deletion via Post Meta Field Injection
drupal/colorbox - SA-CONTRIB-2026-069
drupal/flowdrop - SA-CONTRIB-2026-068
drupal/flowdrop - SA-CONTRIB-2026-067
drupal/canvas - SA-CONTRIB-2026-066
Insert Pages <= 3.11.4 - Authenticated (Author+) Stored Cross-Site Scripting via Custom Field Keys (Meta Key Names)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.