The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,307
Mitigations18,329
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
@azure/msal-node>= 5.0.0-beta.0, < 7.1.0
npm: MSAL Node authorization code flow may disclose parameters to an attacker-controlled endpoint
7.5
1 day ago
undici>= 6.23.0, < 6.29.1
npm: undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
7.5
1 day ago
undici>= 6.5.0, < 6.29.1
npm: undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
5.9
1 day ago
undici>= 7.15.0, < 7.30.1
npm: undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens
5.9
1 day ago
serialize-javascript< 7.1.3
npm: Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body
2.1
1 day ago
multer>= 2.0.0, < 2.5.0
npm: multer vulnerable to Denial of Service via a pending asynchronous fileFilter after request teardown
7.5
1 day ago
happy-dom>= 17.0.0, <= 21.0.3
npm: Happy DOM: Incomplete fix for CVE-2026-33943: unsanitized import alias leads to host code execution
8.8
1 day ago
@fallow-cli/fallow-node< 3.34.0
npm: Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
3.3
1 day ago
fallow< 3.34.0
npm: Fallow: A `.*` glob segment let an analyzed repository make Fallow test paths in the parent of the project root
3.3
1 day ago
@fallow-cli/fallow-node>= 2.68.0, < 3.34.0
npm: Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
3.3
1 day ago
fallow>= 2.68.0, < 3.34.0
npm: Fallow: Jest and Vitest `projects` entries let an analyzed repository make Fallow read files outside the project root
3.3
1 day ago
postal-mime>= 3.0.0, < 4.0.8
npm: postal-mime: Quadratic CPU consumption when decoding a header of many joinable RFC 2047 base64 encoded words
7.5
1 day ago
nodemailer>= 3.0.0, < 10.1.4
npm: Nodemailer: A nested comment ends early in addressparser, releasing the rest of the comment as a recipient
6.5
1 day ago
nodemailer>= 3.0.0, < 10.1.4
npm: Nodemailer: A ";" inside a quoted string or comment ends an address group early in addressparser, turning display text into a recipient
6.5
1 day ago
nodemailer>= 3.0.0, < 10.1.4
npm: Nodemailer: A ">" inside a quoted local part ends an angle-addr early in addressparser, delivering to a domain the header does not name
6.5
1 day ago
fast-uri< 2.4.8
npm: fast-uri vulnerable to URI scheme spoofing via percent-encoded scheme decoding
6.1
1 day ago
fast-uri< 2.4.8
npm: fast-uri vulnerable to improper path equivalence in relative reference normalization
3.7
1 day ago
fast-uri>= 2.4.2, < 2.4.8
npm: fast-uri vulnerable to host confusion via unchecked WHATWG host canonicalization
4.8
1 day ago
fast-uri< 2.4.8
npm: fast-uri vulnerable to scheme injection via an unescaped first-segment colon in suffix references
3.7
1 day ago
@sveltejs/kit< 3.0.0
npm: SvelteKit: URL redirection to untrusted site via enhanced form submission
4.7
1 day ago