The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,245
Mitigations18,299
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
@nuxt/nitro-server>= 3.20.0, < 4.0.0
NPM: Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
6.3
1 hour ago
nuxt>= 3.0.0, < 4.0.0
NPM: Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive
6.3
1 hour ago
nuxt>= 3.13.0, < 4.6.2
NPM: Nuxt server islands render `useHeadSafe` input without sanitisation
5.4
1 hour ago
nuxt< 4.6.0
NPM: Nuxt: Incomplete fix for GHSA-934w-87qh-qr26: a `javascript:` URL prefixed with an ASCII control character executes from `<NuxtLink>` when `pages` is disabled
2.3
1 hour ago
nuxt>= 3.11.0, < 3.21.4
NPM: Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass `appMiddleware` on dynamic and catch-all routes
6.5
1 hour ago
electron< 42.11.3
NPM: Electron: SameSite cookie restrictions are not applied to windows opened from links
4.2
1 hour ago
electron< 42.11.9
NPM: Electron: Pointer lock permission requests can be attributed to the wrong frame
5.4
1 hour ago
electron< 42.11.1
NPM: Electron: Extension tabs.query returns tab URLs and titles without the tabs permission
3.1
1 hour ago
electron< 42.11.6
NPM: Electron: Frame subscription trusts GPU-supplied frame geometry
3.9
1 hour ago
electron< 42.11.6
NPM: Electron: Off-screen rendering on macOS trusts GPU-supplied frame geometry
3.9
1 hour ago
electron< 42.11.3
NPM: Electron: openExternal permission requests can be attributed to the wrong origin
5.4
1 hour ago
next>= 16.0.0, <= 16.4.0
NPM: Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays
9.5
1 hour ago
fastify>= 5.12.2, < 5.12.6
NPM: fastify is vulnerable to header validation bypass via case-sensitive propertyNames
3.7
1 hour ago
tome<= 5.0.0
NPM: toml-node: Prototype pollution: parsing a TOML document can write to Object.prototype
8.8
1 hour ago
toml<= 5.0.0
NPM: toml-node: Quadratic-complexity DoS via many array-of-tables headers in toml.parse()
8.7
1 hour ago
toml<= 5.0.0
NPM: toml-node: Quadratic-complexity DoS via long dotted keys or table paths in toml.parse()
8.7
1 hour ago
toml<= 5.0.0
NPM: toml-node: Uncontrolled resource consumption (CPU DoS) via unbounded-length integer literals in toml.parse()
7.5
1 hour ago
@storybook/addon-mcp>= 10.6.0, < 10.6.2
NPM: Storybook dev server vulnerable to code injection from the local network
8.7
1 hour ago
@storybook/addon-vitest>= 9.0.0, < 9.1.21
NPM: Storybook dev server vulnerable to code injection from the local network
8.7
1 hour ago
@storybook/experimental-addon-test>= 8.0.0, < 8.6.19
NPM: Storybook dev server vulnerable to code injection from the local network
8.7
1 hour ago