The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,491
Mitigations18,484
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
dd-trace>= 2.0.0, < 5.131.1
npm: dd-trace: ReDOS in URL query string obfuscation
8.7
1 hour ago
tinymce7.9.3
npm: TinyMCE Cross-Site Scripting (XSS) vulnerability using media plugin `data-mce-object` serialization
8.5
1 hour ago
@ckeditor/ckeditor5-engine>= 29.0.0, < 47.7.4
npm: CKEditor: Cross-site scripting (XSS) in the engine package
3.1
1 hour ago
ckeditor5>= 29.0.0, < 47.7.4
npm: CKEditor: Cross-site scripting (XSS) in the engine package
3.1
1 hour ago
@ckeditor/ckeditor5-engine>= 45.0.0, < 47.7.4
npm: CKEditor: Cross-site scripting (XSS) in the engine package
8.1
1 hour ago
ckeditor5>= 45.0.0, < 47.7.4
npm: CKEditor: Cross-site scripting (XSS) in the engine package
8.1
1 hour ago
undici>= 7.0.0, < 7.30.1
npm: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
7.4
3 hours ago
undici>= 4.0.0, < 6.29.1
npm: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
7.4
3 hours ago
undici>= 4.2.1, < 6.29.1
npm: undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
7.5
3 hours ago
undici>= 5.15.0, < 6.29.1
npm: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
5.9
3 hours ago
undici>= 7.15.0, < 7.30.1
npm: undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
5.9
3 hours ago
@modelcontextprotocol/hono>= 2.0.0, < 2.0.1
npm: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
7.5
3 hours ago
@modelcontextprotocol/node>= 2.0.0, < 2.1.0
npm: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
7.5
3 hours ago
@modelcontextprotocol/server>= 2.0.0, < 2.1.0
npm: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
7.5
3 hours ago
@modelcontextprotocol/sdk>= 1.10.0, < 1.30.1
npm: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
7.5
3 hours ago
Pie Register Premium<= 3.8.4.0
Unauthenticated Arbitrary File Upload vulnerability
9.8
4 hours ago
yootheme5.0.0-5.0.52
Unauthenticated Arbitrary File Upload vulnerability
9.8
4 hours ago
Ultimate Member<= 2.14.0
Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
6.4
5 hours ago
Document Embedder<= 2.4.0
Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting vulnerability
6.5
5 hours ago
Clean Login<= 1.20.1
Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update vulnerability
4.3
5 hours ago