The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,872
Mitigations18,587
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
LiteSpeed Cache<= 7.9.1
Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
6.5
22 minutes ago
Greenshift<= 13.2.1
Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability
7.1
26 minutes ago
Media LIbrary Assistant<= 3.42
Reflected Cross-Site Scripting vulnerability
7.1
26 minutes ago
NEX-Forms<= 9.3.2
Unauthenticated Stored Cross-Site Scripting vulnerability
7.1
27 minutes ago
Feedzy<= 5.2.12
Unauthenticated Stored Cross-Site Scripting vulnerability
7.1
43 minutes ago
Extension for Leaflet Map<= 5.4
Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability
7.1
43 minutes ago
systeminformation< 5.33.16
npm: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks
7.8
9 hours ago
@backstage/plugin-catalog-backend< 3.9.2
npm: Backstage catalog rules can be bypassed for URL locations using encoded path segments
6.5
9 hours ago
MW WP Form<= 5.1.7
Unauthenticated Sensitive Information Exposure in 'post_id' Parameter vulnerability
5.3
10 hours ago
@waline/vercel<= 1.40.3
npm: Waline login accepts a non-string email as a match-all MongoDB query
6.5
10 hours ago
seroval>= 1.6.0, < 1.6.11
npm: Seroval: Code injection through a typed array's own constructor property
5.3
10 hours ago
seroval< 1.0.0
npm: Seroval: Script injection through RegExp sources in serialized output
4.7
10 hours ago
seroval<= 1.6.7
npm: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)
7.5
10 hours ago
seroval>= 1.4.1, <= 1.6.7
npm: Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
7.5
10 hours ago
seroval<= 1.6.7
npm: Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check
7.3
10 hours ago
mem0ai< 3.1.6
npm: Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
6.3
10 hours ago
systeminformation< 5.33.14
npm: systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
3.3
10 hours ago
systeminformation< 5.33.13
npm: systeminformation has prototype pollution in `networkStats()` via the interface name
6.5
10 hours ago
graphql-scalars<= 2.0.0
npm: graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service
7.5
10 hours ago
i18next-http-backend< 4.0.4
npm: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
3.7
10 hours ago