The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,480
Mitigations18,464
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
undici>= 7.0.0, < 7.30.1
npm: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
7.4
24 minutes ago
undici>= 4.0.0, < 6.29.1
npm: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
7.4
24 minutes ago
undici>= 4.2.1, < 6.29.1
npm: undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
7.5
24 minutes ago
undici>= 5.15.0, < 6.29.1
npm: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
5.9
24 minutes ago
undici>= 7.15.0, < 7.30.1
npm: undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
5.9
25 minutes ago
@modelcontextprotocol/hono>= 2.0.0, < 2.0.1
npm: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
7.5
25 minutes ago
@modelcontextprotocol/node>= 2.0.0, < 2.1.0
npm: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
7.5
25 minutes ago
@modelcontextprotocol/server>= 2.0.0, < 2.1.0
npm: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
7.5
25 minutes ago
@modelcontextprotocol/sdk>= 1.10.0, < 1.30.1
npm: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
7.5
25 minutes ago
Pie Register Premium<= 3.8.4.0
Unauthenticated Arbitrary File Upload vulnerability
9.8
1 hour ago
yootheme5.0.0-5.0.52
Unauthenticated Arbitrary File Upload vulnerability
9.8
1 hour ago
Ultimate Member<= 2.14.0
Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
6.4
1 hour ago
JupiterX Core<= 4.61.0
Unauthenticated Authentication Bypass vulnerability
9.8
1 hour ago
affiliate-toolkit<= 3.9.2
Authenticated (Contributor+) Arbitrary File Upload vulnerability
7.5
1 hour ago
Appointment Booking Calendar<= 1.4.05
Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
6.5
1 hour ago
Animated Text Block<= 1.2.6
Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability
7.5
2 hours ago
qs>= 6.7.0, <= 6.16.0
npm: qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)
5.3
3 hours ago
undici>= 8.11.0, < 8.11.2
npm: undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
7.5
3 hours ago
Newsletters<= 4.18.2
Cross Site Request Forgery (CSRF) vulnerability
9.6
3 hours ago
AI Engine<= 3.8.4
Authenticated (Subscriber+) Limited Media File Deletion vulnerability
4.2
3 hours ago