The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,018
Mitigations18,239
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
@modelcontextprotocol/server-legacy>= 2.0.0, < 2.3.1
NPM: MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
6.8
14 minutes ago
@modelcontextprotocol/express>= 2.0.0, < 2.0.2
NPM: MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
6.8
14 minutes ago
@modelcontextprotocol/server>= 2.0.0, < 2.3.0
NPM: MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
6.8
14 minutes ago
@modelcontextprotocol/sdk>= 1.6.0, < 1.32.0
NPM: MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
6.8
14 minutes ago
vite-plus<= 1.0.0
NPM: launch-editor: escapeCmdArgs() omits % escaping on Windows
6.3
1 hour ago
vite<= 6.4.3
NPM: launch-editor: escapeCmdArgs() omits % escaping on Windows
6.3
1 hour ago
launch-editor<= 2.14.1
NPM: launch-editor: escapeCmdArgs() omits % escaping on Windows
6.3
1 hour ago
@modelcontextprotocol/sdk>= 1.24.0, < 1.32.0
NPM: MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
8.6
1 hour ago
@modelcontextprotocol/client>= 2.0.0, < 2.3.0
NPM: MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
6.5
1 hour ago
@modelcontextprotocol/sdk< 1.32.0
NPM: MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
6.5
1 hour ago
apostrophe< 4.33.0
NPM: ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
6.9
1 hour ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
3.7
1 hour ago
@apostrophecms/import-export< 3.7.0
NPM: ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
5.3
1 hour ago
uploadfs< 1.28.0
NPM: ApostropheCMS: Path traversal in uploadfs
3.3
1 hour ago
sanitize-html>= 2.17.7, < 2.18.0
NPM: ApostropheCMS sanitize-html: SMIL animation namespace-prefix bypass allows javascript: URI injection (XSS)
3.7
1 hour ago
uploadfs>= 1.25.0, < 1.28.0
NPM: ApostropheCMS uploadfs Azure backend leaks account-level SAS token into every public attachment URL (sas: true)
5.6
1 hour ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
4.3
1 hour ago
@apostrophecms/import-export< 3.7.0
NPM: ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
5.4
1 hour ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Client-side Prototype Pollution in apos.http.parseQuery leading to DOM-based XSS against authenticated users
6.1
1 hour ago
apostrophe< 4.33.0
NPM: ApostropheCMS: No Attempt Throttling on Authenticated Password-Change Endpoint Enables Unlimited Current-Password Guessing
5.9
1 hour ago