The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total56,780
Mitigations19,218
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
mongoose< 6.13.12
npm: Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections
4.8
20 minutes ago
mongoose< 6.13.12
npm: Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state
8.2
21 minutes ago
mongoose< 6.13.12
npm: Mongoose: Prototype pollution via Schema.prototype.virtual()
6.5
30 minutes ago
Joinchat<= 6.3.1
Reflected Cross-Site Scripting vulnerability
7.1
1 hour ago
mongoose>= 6.0.0, < 6.13.12
npm: Mongoose: Connection-level sanitizeFilter not applied
7.5
1 hour ago
ARForms<= 7.2.4
Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header vulnerability
8.1
1 hour ago
ARForms<= 7.2.4
Unauthenticated Stored Cross-Site Scripting via Referer Header vulnerability
7.1
1 hour ago
ARForms<= 7.2.4
Unauthenticated Stored Cross-Site Scripting via 'description' Parameter vulnerability
7.1
1 hour ago
mongoose< 6.13.11
npm: Mongoose: sanitizeFilter not applied on countDocuments
9.8
1 hour ago
@nocobase/plugin-action-custom-request>= 2.1.0-alpha.8, < 2.1.15
npm: NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides
4.3
1 hour ago
WPIDE – File Manager & Code Editor<= 3.6.4
Cross Site Request Forgery (CSRF) vulnerability
8.8
5 hours ago
@ohif/extension-dicom-pdf>= 3.5.0-beta.0, < 3.12.18
npm: OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document
8.8
5 hours ago
node-forge<= 1.4.0
npm: Forge: Certificate signature verified with the issuer's RSA signature scheme
3.7
5 hours ago
node-forge<= 1.4.0
npm: Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption
3.7
5 hours ago
node-forge<= 1.4.0
npm: Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
5.9
5 hours ago
node-forge<= 1.4.0
npm: Forge: ASN.1 resource exhaustion via BIT STRING decoding in asn1.fromDer
7.5
5 hours ago
node-forge<= 1.4.0
npm: Forge: RSA PKCS#1 v1.5 signature forgery via non-canonical DigestInfo encoding
7.5
5 hours ago
effect>= 4.0.0-beta.0, < 4.0.0-beta.103
npm: Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
6.3
5 hours ago
@effect/platform>= 0.1.0, < 0.97.1
npm: Effect: Cookie attribute injection via domain, path, and name fields in @effect/platform makeCookie()
6.3
5 hours ago
altair-fastify-plugin>= 7.2.4, < 8.5.8
npm: Altair: DOM-based XSS via attacker-controlled script URLs in the iframe sandbox
6.1
5 hours ago