Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,534
Apache CXF OAuth2 has Inverted IP Binding Check that Defeats Security Control
Apache CXF OAuth2 TOCTOU Race Condition in Refresh Token Processing
Apache CXF OAuth2 Missing JWT Audience and Issuer Validation in Access Token Validator
Apache CXF OAuth2 HTTP Response Splitting via WWW-Authenticate Realm Injection
Hash Elements <= 1.5.4 - Authenticated (Contributor+) Information Exposure
Fediverse Embeds <= 1.5.7 - Unauthenticated Server-Side Request Forgery
WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 - Unauthenticated Arbitrary File Download
Fediverse Embeds <= 1.5.7 - Unauthenticated Server-Side Request Forgery
BookPro <= 1.1.0 - Unauthenticated Arbitrary File Deletion
SEO Redirection Plugin – 301 Redirect Manager <= 9.17 - Unauthenticated Stored Cross-Site Scripting
Nifty <= 1.4.1 - Unauthenticated PHP Object Injection
WordPress & WooCommerce Scraper Plugin, Import Data from Any WebSite. <= 1.0.7 - Unauthenticated Arbitrary File Upload
JetEngine <= 3.8.10 - Unauthenticated PHP Object Injection
FastDup – Fastest WordPress Migration & Duplicator <= 2.7.2 - Unauthenticated Path Traversal
Really Simple Security <= 9.5.10.0 - Two Factor Authentication Bypass
Kastell <= 2.0 - Unauthenticated Local File Inclusion
@steipete/summarize vulnerable to SSRF via podcast:transcript URL fetch
@steipete/summarize is Vulnerable to Disk Exhaustion via Crafted Media Responses
MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input
GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
Filament has inconsistent scope enforcement for its AttachAction and AssociateAction Select fields
Netty HAProxy: Unbalanced Reference Count in Nested PP2_TYPE_SSL TLV Parsing Leads to Memory Exhaustion
Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.