Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Ibexa User Bundle is missing password change validation
drupal/acquia_contenthub - SA-CONTRIB-2025-125
ImageMagick is vulnerable to an integer Overflow in TIM decoder leading to out of bounds read (32-bit only)
XWiki vulnerable to remote code execution through insufficient protection against {{/html}} injection
XWiki's REST APIs don't enforce any limits, leading to unavailability and OOM in large wikis
XWiki vulnerable to a reflected XSS via xredirect parameter in DeleteApplication
Widgets for Google Reviews <= 13.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via trustindex Shortcode
List Category Posts <= 0.91.0 - Authenticated (Contributor+) SQL Injection via Plugin's Shortcode
Apache Struts has a Denial of Service vulnerability
RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator <= 5.1.1 - Unauthenticated Blind Server-Side Request Forgery
WP CarDealer <= 1.2.16 - Unauthenticated Privilege Escalation
Keycloak Admin REST (Representational State Transfer) API does not properly enforce permissions
Fetch MCP Server has a Server-Side Request Forgery (SSRF) vulnerability
Leaky Paywall <= 4.22.6 - Missing Authorization
Motionger for Elementor <= 2.0.4 - Missing Authorization
Knowband Mobile App Builder <= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary User Deletion
Searcher for Elementor <= 1.0.3 - Missing Authorization
Nelio Popups <= 1.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Homey Core <= 2.4.3 - Missing Authorization
Ultimate Post Kit <= 4.0.15 - Unauthenticated Information Disclosure
Audier For Elementor <= 1.0.9 - Missing Authorization
Scroller <= 2.0.2 - Missing Authorization
Comparimager for Elementor <= 1.0.1 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.