Free plan, no credit card, first error in minutes.
Create a Project for FreeDiscover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
A vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF) allows crafted pixel-shader bytecode to cause heap out-of-bounds writes or reads, potentially leading to remote code execution.
A remote code execution vulnerability in Microsoft WindowsDesktop App Runtime allows attacker-controlled content to be reached via WPF XPS synthetic hyperlinks exposed through UI Automation. Successful exploitation requires user interaction and affects supported .NET applications.
A remote code execution vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF) allows crafted pixel-shader bytecode to desynchronize parsing passes, leading to heap out-of-bounds memory corruption. Patched runtime and SDK versions have been released to resolve the issue.
A denial of service vulnerability in ASP.NET Core Kestrel allows unauthenticated remote attackers to trigger deadlocks in connection handling, causing thread exhaustion and server resource depletion.
A remote code execution vulnerability exists in .NET and Visual Studio due to improper untrusted data deserialization in Windows Desktop runtime packages. Applications using affected runtime versions should be updated to patched releases and recompiled if deployed as self-contained applications.
A vulnerability in Microsoft.WindowsDesktop.App.Runtime (WPF) allows attacker-controlled XPS glyph coordinates to overflow pointer arithmetic, causing an out-of-bounds write and process termination.
A spoofing vulnerability in System.Security.Cryptography.Xml allows serialized certificates with attacker-controlled chain metadata to be accepted, enabling certificate forgery and token spoofing. Mitigation requires updating .NET runtimes, SDKs, and affected package references.
An elevation of privilege vulnerability in Microsoft.AspNetCore.Authentication.Negotiate allows authenticated identities to be linked to unintended LDAP principals when SID verification fails. Affected systems should apply the latest .NET updates.
A vulnerability in Microsoft.AspNetCore.Components.WebAssembly.Server allows cross-origin script injection due to unencoded exception text in the Blazor development server debug page.
A denial of service vulnerability exists in .NET and Visual Studio packages System.Security.Cryptography.Xml and System.Private.Xml due to unbounded resource allocation. Remediate by updating packages and runtimes.
A Use After Free flaw in Microsoft.Native.Quic.MsQuic.Schannel on Windows exposes .NET applications to information disclosure. Developers should update to the latest .NET release or reference the patched package, then restart or recompile affected apps.
A denial of service vulnerability in Microsoft .NET's System.Security.Cryptography.Xml and System.Private.Xml allows asymmetric resource consumption. Developers should update affected packages or runtimes to the patched versions and recompile self-contained apps.
A denial of service vulnerability in ASP.NET Core SignalR components allows stateful reconnect clients to indefinitely block broadcasts and retain associated resources.
A code injection vulnerability in TinaCMS CLI allows arbitrary JavaScript execution during project builds when an unescaped Git branch name is embedded directly into generated client source files.
TinaCMS admin preview iframe loads an attacker-controlled origin from the URL fragment. If an authenticated editor opens a crafted link, an unauthenticated remote attacker can gain arbitrary read and write access to the site's content API as that editor.
A stored cross-site scripting vulnerability in @tinacms/web-components allows attackers with content editing privileges to execute arbitrary scripts via unvalidated link URL schemes in rich-text content.
A path traversal vulnerability in Shiny for Python allows unauthenticated remote attackers to probe file existence and JSON validity via bookmark restoration, or read arbitrary files when server-side bookmarking and file inputs are configured.
Disabling protected page indexing in Contao without clearing existing index records can expose member-only titles, URLs, and text snippets to anonymous visitors via the site search.
A vulnerability in Contao's registration module allows unauthenticated attackers to repeatedly trigger activation emails to arbitrary addresses. This creates an email flooding risk and discloses whether an email address has a pending registration.
A cross-site request forgery vulnerability in Contao allows attackers to trigger state-changing or destructive backend actions if an authenticated backend user visits a malicious URL.
A path traversal vulnerability in Contao's images controller allows unauthenticated visitors to read image files located outside the document root and verify path existence within the project directory.
An unauthenticated cross-site scripting vulnerability in Contao's comments bundle allows attackers to inject malicious script that executes when a back end user views the Comments module, potentially leading to administrative takeover or code execution.
An access control flaw in Contao allows non-administrator back end users with access to the preview links module to view all preview links, exposing signed preview URLs for unpublished content.
A caching defect in Contao's table access security voter allows low-privileged backend users to bypass module permissions and gain unauthorized read, create, update, and delete access to database tables.
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.