The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,014
Mitigations18,239
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
vite-plus<= 1.0.0
NPM: launch-editor: escapeCmdArgs() omits % escaping on Windows
6.3
45 minutes ago
vite<= 6.4.3
NPM: launch-editor: escapeCmdArgs() omits % escaping on Windows
6.3
45 minutes ago
launch-editor<= 2.14.1
NPM: launch-editor: escapeCmdArgs() omits % escaping on Windows
6.3
45 minutes ago
@modelcontextprotocol/sdk>= 1.24.0, < 1.32.0
NPM: MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
8.6
48 minutes ago
@modelcontextprotocol/client>= 2.0.0, < 2.3.0
NPM: MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
6.5
49 minutes ago
@modelcontextprotocol/sdk< 1.32.0
NPM: MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
6.5
49 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
6.9
49 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
3.7
50 minutes ago
@apostrophecms/import-export< 3.7.0
NPM: ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
5.3
51 minutes ago
uploadfs< 1.28.0
NPM: ApostropheCMS: Path traversal in uploadfs
3.3
53 minutes ago
sanitize-html>= 2.17.7, < 2.18.0
NPM: ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
3.7
54 minutes ago
uploadfs>= 1.25.0, < 1.28.0
NPM: ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
5.6
55 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
4.3
56 minutes ago
@apostrophecms/import-export< 3.7.0
NPM: ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
5.4
56 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
6.1
56 minutes ago
apostrophe< 4.33.0
NPM: ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
5.9
57 minutes ago
sanitize-html< 2.18.0
NPM: ApostropheCMS: Incomplete CVE-2026-53606: `meta http-equiv=refresh` `content` still ships `javascript:` / `data:` URLs
5.4
1 hour ago
apostrophe< 4.33.0
NPM: ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
5.3
1 hour ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Page REST API authorization bypass
5.3
1 hour ago
@apostrophecms/ai-helper>= 1.0.0-beta.10, < 1.0.0-beta.13
NPM: ApostropheCMS: Host header controls server-side image fetch origin in @apostrophecms/ai-helper, enabling authenticated SSRF
4.3
1 hour ago