The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,147
Mitigations18,278
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
Tailored Tools<= 3.0.3
Cross Site Request Forgery (CSRF) vulnerability
6.5
9 minutes ago
H5P<= 1.17.9
Insecure Direct Object References (IDOR) vulnerability
4.3
11 minutes ago
eRoom<= 1.7.1
Broken Access Control vulnerability
4.3
12 minutes ago
Node.js< 22.23.4
Permission Model Bypass via fs.realpathSync() Path Probing
3.3
41 minutes ago
Node.js26.0.0-26.12.0
Permission Model Filesystem Over-Grant via Wildcard Radix Tree Lookup
3.3
43 minutes ago
Node.js26.0.0-26.12.0
Exposure of Sensitive Information via Cached Invalid ZIP Local Headers
3.1
47 minutes ago
@storybook/addon-mcp>= 10.6.0, < 10.6.2
NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
9.4
47 minutes ago
@storybook/addon-vitest>= 9.0.0, < 9.1.21
NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
9.4
47 minutes ago
@storybook/experimental-addon-test>= 8.0.0, < 8.6.19
NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
9.4
47 minutes ago
@storybook/core-server>= 8.0.0, < 8.6.19
NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
9.4
47 minutes ago
@storybook/core>= 8.0.0, < 8.6.19
NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
9.4
47 minutes ago
storybook>= 8.0.0, < 8.6.19
NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
9.4
47 minutes ago
electron< 42.11.3
NPM: Electron: HID and USB permission checks can be attributed to the wrong origin
5.4
49 minutes ago
Node.js< 22.23.4
Improper Certificate Validation for Non-Canonical IPv4 Hostnames
5.9
52 minutes ago
apostrophe< 4.34.0
NPM: ApostropheCMS: POST /api/v1/@apostrophecms/doc/slugTaken discloses existence of private/admin-only content to any authenticated user
4.3
54 minutes ago
Node.js< 22.23.4
HTTP Response Desynchronization on Pooled Keep-Alive Sockets
6.5
54 minutes ago
apostrophe< 4.34.0
NPM: ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
4.3
55 minutes ago
apostrophe< 4.34.0
NPM: ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
5.4
56 minutes ago
@apostrophecms/import-export< 3.7.1
NPM: ApostropheCMS: Missing Authentication in `cleanExport` Route
3.1
57 minutes ago
Node.js< 22.23.4
Out-of-Bounds Write in the Bundled Brotli Decoder leading to Remote Code Execution
8.1
58 minutes ago