The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total55,024
Mitigations18,239
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
vite-plus<= 1.0.0
NPM: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
6.3
24 minutes ago
vite<= 6.4.3
NPM: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
6.3
24 minutes ago
launch-editor<= 2.14.1
NPM: launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors
6.3
24 minutes ago
vite-plus<= 1.0.0
NPM: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
7.5
27 minutes ago
vite<= 6.4.3
NPM: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
7.5
27 minutes ago
launch-editor<= 2.14.1
NPM: launch-editor: `fs.existsSync()` existence check can be bypassed on Windows
7.5
27 minutes ago
@modelcontextprotocol/server-legacy>= 2.0.0, < 2.3.1
NPM: MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
6.8
32 minutes ago
@modelcontextprotocol/express>= 2.0.0, < 2.0.2
NPM: MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
6.8
32 minutes ago
@modelcontextprotocol/server>= 2.0.0, < 2.3.0
NPM: MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
6.8
32 minutes ago
@modelcontextprotocol/sdk>= 1.6.0, < 1.32.0
NPM: MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
6.8
32 minutes ago
vite-plus<= 1.0.0
NPM: launch-editor: escapeCmdArgs() omits % escaping on Windows
6.3
1 hour ago
vite<= 6.4.3
NPM: launch-editor: escapeCmdArgs() omits % escaping on Windows
6.3
1 hour ago
launch-editor<= 2.14.1
NPM: launch-editor: escapeCmdArgs() omits % escaping on Windows
6.3
1 hour ago
@modelcontextprotocol/sdk>= 1.24.0, < 1.32.0
NPM: MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
8.6
1 hour ago
@modelcontextprotocol/client>= 2.0.0, < 2.3.0
NPM: MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
6.5
1 hour ago
@modelcontextprotocol/sdk< 1.32.0
NPM: MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
6.5
1 hour ago
apostrophe< 4.33.0
NPM: ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
6.9
1 hour ago
apostrophe< 4.33.0
NPM: ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
3.7
1 hour ago
@apostrophecms/import-export< 3.7.0
NPM: ApostropheCMS import-export tar guard misses './..' because it is a literal '../' substring test
5.3
1 hour ago
uploadfs< 1.28.0
NPM: ApostropheCMS: Path traversal in uploadfs
3.3
1 hour ago