Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,632
Jenkins has a log message injection vulnerability
Jenkins has a missing permission check, allowing users to obtain agent names
Jenkins is missing a permission check in the authenticated users' profile menu
Picklescan is Vulnerable to Unsafe Globals Check Bypass through Subclass Imports
Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check
Picklescan Bypass is Possible via File Extension Mismatch
Liferay search widget vulnerable to Cross-site Scripting
Liferay Portal allows remote attackers to view display page templates via crafted URLs
Kubernetes C# client accepts certificates from any CA without properly verifying the trust chain
Leblix <= 2.4 - Unauthenticated Local File Inclusion
Entrada <= 5.7.7 - Cross-Site Request Forgery
Find Me On <= 2.0.9.1 - Authenticated (Subscriber+) SQL Injection
Medcity < 1.1.9 - Unauthenticated Arbitrary File Upload
Quantities and Units for WooCommerce <= 1.0.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Chained Quiz <= 1.3.5 - Unauthenticated Insecure Direct Object Reference via Cookie
Essential Addons for Elementor <= 6.2.4 - Missing Authorization
Timing Attack Vulnerability in SCRAM Authentication
matrix-js-sdk has insufficient validation when considering a room to be upgraded by another
@executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode
JasperReports has a Java deserialisation vulnerability
Liferay Portal has unchecked input for loop condition vulnerability in XML-RPC
Media Player Addons for Elementor <= 1.0.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widget Fields
Blocksy Companion <= 2.1.10 - Authenticated (Contributor+) Stored Cross-Site Scripting via blocksy_newsletter_subscribe Shortcode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.