The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,872
Mitigations18,584
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
Feedzy<= 5.2.12
Unauthenticated Stored Cross-Site Scripting vulnerability
7.1
17 minutes ago
Extension for Leaflet Map<= 5.4
Unauthenticated Stored DOM-Based Cross-Site Scripting vulnerability
7.1
17 minutes ago
systeminformation< 5.33.16
npm: systeminformation vulnerable to Windows command injection in services() through Unicode quotation marks
7.8
8 hours ago
@backstage/plugin-catalog-backend< 3.9.2
npm: Backstage catalog rules can be bypassed for URL locations using encoded path segments
6.5
8 hours ago
MW WP Form<= 5.1.7
Unauthenticated Sensitive Information Exposure in 'post_id' Parameter vulnerability
5.3
9 hours ago
@waline/vercel<= 1.40.3
npm: Waline login accepts a non-string email as a match-all MongoDB query
6.5
10 hours ago
seroval>= 1.6.0, < 1.6.11
npm: Seroval: Code injection through a typed array's own constructor property
5.3
10 hours ago
seroval< 1.0.0
npm: Seroval: Script injection through RegExp sources in serialized output
4.7
10 hours ago
seroval<= 1.6.7
npm: Seroval: fromJSON deserializer trusts node-supplied array length and sequence doneAt (unauthenticated event-loop DoS)
7.5
10 hours ago
seroval>= 1.4.1, <= 1.6.7
npm: Seroval `fromJSON`/`fromCrossJSON` denial of service via unvalidated array node length
7.5
10 hours ago
seroval<= 1.6.7
npm: Seroval: Deserialization invokes attacker-chosen callables: AsyncIteratorFactoryInstance calls source.on(listener) without type check
7.3
10 hours ago
mem0ai< 3.1.6
npm: Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (_build_session_scope)
6.3
10 hours ago
systeminformation< 5.33.14
npm: systeminformation has path traversal in Linux networkStats() that allows symlink-based file disclosure outside /sys/class/net
3.3
10 hours ago
systeminformation< 5.33.13
npm: systeminformation has prototype pollution in `networkStats()` via the interface name
6.5
10 hours ago
graphql-scalars<= 2.0.0
npm: graphql-scalars PhoneNumber scalar is vulnerable to regular expression denial of service
7.5
10 hours ago
i18next-http-backend< 4.0.4
npm: i18next-http-backend: Query-parameter injection through & and = in lng when loadPath/addPath puts {{lng}} in the query string
3.7
10 hours ago
re2js>= 2.2.0, < 2.8.7
npm: RE2JS: Quadratic-time denial of service in re2js lookbehind matching
7.5
10 hours ago
i18next-http-backend< 4.0.3
npm: i18next-http-backend: Namespace value starting with / forms a protocol-relative URL when loadPath/addPath places {{ns}} right after a / (bypass of the // check added for GHSA-xvq9-wjp8-hwqf)
3.1
10 hours ago
happy-dom<= 20.14.6
npm: Happy DOM: SSRF via iframe and link stylesheet when parsing untrusted HTML
8.6
10 hours ago
@intlify/vue-i18n-core>= 9.2.0-alpha.7, < 11.4.14
npm: Vue I18n: `escapeParameter` does not escape named values when the same call also passes a list
2.1
10 hours ago