The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total56,148
Mitigations18,959
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
@hapi/joi>= 16.0.0, <= 17.1.1
npm: joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
7.5
1 hour ago
joi>= 17.1.1, < 17.13.9
npm: joi: quadratic-time split in `string().email({ multiple: true })` allows denial of service
7.5
1 hour ago
content>= 3.0.6, <= 4.0.6
npm: @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service
7.5
1 hour ago
@hapi/content<= 6.0.2
npm: @hapi/content: quadratic-time parsing of Content-Disposition parameters allows denial of service
7.5
1 hour ago
minimatch< 11.0.1
npm: minimatch has potential denial of service via globparts amplification
6.9
1 hour ago
glob>= 9.0.0, <= 14.0.1
npm: Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal
6.3
1 hour ago
node-forge<= 1.4.0
npm: Forge: ASN.1 OID first arc truncation in asn1.oidToDer
3.7
1 hour ago
node-forge<= 1.4.0
npm: Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie
4.8
1 hour ago
node-forge<= 1.4.0
npm: Forge: TLS client crash when the server sends no certificate
5.9
1 hour ago
node-forge<= 1.4.0
npm: Forge: Regular expression denial of service in PEM decoding (pem.decode)
7.5
1 hour ago
node-forge<= 1.4.0
npm: Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)
2.9
1 hour ago
node-forge<= 1.4.0
npm: Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store
3.7
1 hour ago
node-forge<= 1.4.0
npm: Forge: AES-GCM authentication bypass via unvalidated tagLength option
5.9
1 hour ago
node-forge<= 1.4.0
npm: Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count
7.5
1 hour ago
node-forge<= 1.4.0
npm: Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message
7.5
1 hour ago
node-forge<= 1.4.0
npm: Forge: Denial of service in TLS record processing via call stack exhaustion
7.5
1 hour ago
node-forge<= 1.4.0
npm: Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13
7.4
1 hour ago
@nuxt/vite-builder>= 4.6.0, < 4.6.3
npm: Nuxt dev server exposes generated appSecret through Vite file serving
4.8
1 hour ago
@nuxt/nitro-server>= 4.6.0, < 4.6.3
npm: Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
6.5
1 hour ago
nuxt>= 4.6.0, < 4.6.3
npm: Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes
6.5
1 hour ago