The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,484
Mitigations18,484
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
undici>= 7.0.0, < 7.30.1
npm: undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
7.4
1 hour ago
undici>= 4.0.0, < 6.29.1
npm: undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
7.4
1 hour ago
undici>= 4.2.1, < 6.29.1
npm: undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
7.5
1 hour ago
undici>= 5.15.0, < 6.29.1
npm: undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
5.9
1 hour ago
undici>= 7.15.0, < 7.30.1
npm: undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
5.9
1 hour ago
@modelcontextprotocol/hono>= 2.0.0, < 2.0.1
npm: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
7.5
1 hour ago
@modelcontextprotocol/node>= 2.0.0, < 2.1.0
npm: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
7.5
1 hour ago
@modelcontextprotocol/server>= 2.0.0, < 2.1.0
npm: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
7.5
1 hour ago
@modelcontextprotocol/sdk>= 1.10.0, < 1.30.1
npm: MCP TypeScript SDK: HTTP server transports and handlers did not limit request body size or JSON-RPC batch length
7.5
1 hour ago
Pie Register Premium<= 3.8.4.0
Unauthenticated Arbitrary File Upload vulnerability
9.8
3 hours ago
yootheme5.0.0-5.0.52
Unauthenticated Arbitrary File Upload vulnerability
9.8
3 hours ago
Ultimate Member<= 2.14.0
Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
6.4
3 hours ago
Document Embedder<= 2.4.0
Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting vulnerability
6.5
3 hours ago
Clean Login<= 1.20.1
Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update vulnerability
4.3
3 hours ago
JupiterX Core<= 4.61.0
Unauthenticated Authentication Bypass vulnerability
9.8
3 hours ago
affiliate-toolkit<= 3.9.2
Authenticated (Contributor+) Arbitrary File Upload vulnerability
7.5
3 hours ago
Appointment Booking Calendar<= 1.4.05
Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability
6.5
3 hours ago
Animated Text Block<= 1.2.6
Missing Authorization to Unauthenticated Sensitive Information Exposure vulnerability
7.5
3 hours ago
qs>= 6.7.0, <= 6.16.0
npm: qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)
5.3
4 hours ago
undici>= 8.11.0, < 8.11.2
npm: undici WebSocket client vulnerable to Denial of Service via failed HTTP/2 handshake
7.5
4 hours ago