The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total56,777
Mitigations19,218
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
Joinchat<= 6.3.1
Reflected Cross-Site Scripting vulnerability
7.1
16 minutes ago
mongoose>= 6.0.0, < 6.13.12
npm: Mongoose: Connection-level sanitizeFilter not applied
7.5
19 minutes ago
ARForms<= 7.2.4
Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header vulnerability
8.1
29 minutes ago
ARForms<= 7.2.4
Unauthenticated Stored Cross-Site Scripting via Referer Header vulnerability
7.1
30 minutes ago
ARForms<= 7.2.4
Unauthenticated Stored Cross-Site Scripting via 'description' Parameter vulnerability
7.1
30 minutes ago
mongoose< 6.13.11
npm: Mongoose: sanitizeFilter not applied on countDocuments
9.8
37 minutes ago
@nocobase/plugin-action-custom-request>= 2.1.0-alpha.8, < 2.1.15
npm: NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides
4.3
54 minutes ago
WPIDE – File Manager & Code Editor<= 3.6.4
Cross Site Request Forgery (CSRF) vulnerability
8.8
4 hours ago
@ohif/extension-dicom-pdf>= 3.5.0-beta.0, < 3.12.18
npm: OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document
8.8
4 hours ago
node-forge<= 1.4.0
npm: Forge: Certificate signature verified with the issuer's RSA signature scheme
3.7
4 hours ago
node-forge<= 1.4.0
npm: Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption
3.7
4 hours ago
node-forge<= 1.4.0
npm: Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
5.9
4 hours ago
node-forge<= 1.4.0
npm: Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
7.5
4 hours ago
node-forge<= 1.4.0
npm: Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding
7.5
4 hours ago
effect>= 4.0.0-beta.0, < 4.0.0-beta.103
npm: Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
6.3
4 hours ago
@effect/platform>= 0.1.0, < 0.97.1
npm: Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
6.3
4 hours ago
altair-fastify-plugin>= 7.2.4, < 8.5.8
npm: Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
6.1
4 hours ago
altair-koa-middleware>= 7.2.4, < 8.5.8
npm: Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
6.1
4 hours ago
altair-express-middleware>= 7.2.4, < 8.5.8
npm: Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
6.1
4 hours ago
altair-static>= 7.2.4, < 8.5.8
npm: Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
6.1
4 hours ago