Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,445
Groundhogg — CRM, Newsletters, and Marketing Automation <= 4.5 - Authenticated (Sales representative+) SQL Injection
Lemur: ACME SSRF + creator-equality IDOR lead to AWS IAM/PKI compromise
ImageMagick has out-of-bounds write in ICON decoder due to incorrect loop
ImageMagick: Policy Bypass can Trigger an Out-of-Memory condition
ImageMagick: Policy Bypass can read disallowed files via symlink
ImageMagick: Policy Bypass in DCM decoder could result in image with invalid dimensions
ImageMagick has a Heap Buffer Over-Write in MAT decoder on 32-bit systems
ImageMagick Vulnerable to Stack Overflow in its MVG Decoder
ImageMagick has an Infinite Loop in subimage-search with crafted image
ImageMagick has a Heap Buffer Underwrite in the Floyd-Steinberg depth dithering method
nextflow auth login command has incorrect default permissions
MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments
MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings
MessagePack-CSharp: Multi-dimensional array formatters allocate from unchecked dimensions
MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length
MessagePack-CSharp: DynamicUnionResolver-generated deserializers miss depth enforcement
MessagePack-CSharp: JSON conversion APIs can recurse without consistent depth enforcement
User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass
MessagePack-CSharp: ExpandoObject formatter can perform quadratic insertion work on untrusted maps
MessagePack-CSharp: LZ4 decompression allocates from unbounded declared output lengths
MessagePack-CSharp: ASP.NET Core MessagePackInputFormatter defaults to TrustedData for HTTP request bodies
MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth
Filament: Multi-factor authentication (app) recovery codes can still be used multiple times via concurrent submission
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.