The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing
Rated 4.9
Total56,785
Mitigations19,218
Stats
CVSS0
10
Affected software | Vulnerability
RiskDisclosed
node-forge<= 1.4.2
npm: Forge: Ed25519 signature verification accepts small-order public keys
3.7
57 minutes ago
node-forge<= 1.4.2
npm: Forge: TLS client crash on an unsupported ServerHello compression method
5.9
58 minutes ago
node-forge>= 0.1.2, <= 1.4.2
npm: Forge: ReDoS in forge.http response header and cookie trimming
5.9
59 minutes ago
node-forge<= 1.4.2
npm: Forge: TLS client crash on a handshake record received without a session
5.9
1 hour ago
fast-xml-parser<= 5.11.2
npm: fast-xml-parser: Quadratic CPU consumption scanning unterminated stop-node tags
3.7
1 hour ago
mongoose< 6.13.12
npm: Mongoose: Discriminator key values matching inherited properties (e.g. __t: 'constructor') bypass schema casting and can poison collections
4.8
1 hour ago
mongoose< 6.13.12
npm: Mongoose walks into inherited properties when hydrating, setting, and merging, allowing overwrites of built-in functions (denial of service) and shared schema state
8.2
1 hour ago
mongoose< 6.13.12
npm: Mongoose: Prototype pollution via Schema.prototype.virtual()
6.5
1 hour ago
Joinchat<= 6.3.1
Reflected Cross-Site Scripting vulnerability
7.1
2 hours ago
mongoose>= 6.0.0, < 6.13.12
npm: Mongoose: Connection-level sanitizeFilter not applied
7.5
2 hours ago
ARForms<= 7.2.4
Unauthenticated Arbitrary File Upload to Remote Code Execution via X-FILENAME Header vulnerability
8.1
2 hours ago
ARForms<= 7.2.4
Unauthenticated Stored Cross-Site Scripting via Referer Header vulnerability
7.1
2 hours ago
ARForms<= 7.2.4
Unauthenticated Stored Cross-Site Scripting via 'description' Parameter vulnerability
7.1
2 hours ago
mongoose< 6.13.11
npm: Mongoose: sanitizeFilter not applied on countDocuments
9.8
2 hours ago
@nocobase/plugin-action-custom-request>= 2.1.0-alpha.8, < 2.1.15
npm: NocoBase: @nocobase/plugin-action-custom-request allows server-side request forgery through runtime URL overrides
4.3
2 hours ago
WPIDE – File Manager & Code Editor<= 3.6.4
Cross Site Request Forgery (CSRF) vulnerability
8.8
6 hours ago
@ohif/extension-dicom-pdf>= 3.5.0-beta.0, < 3.12.18
npm: OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through MIME type of document
8.8
6 hours ago
node-forge<= 1.4.0
npm: Forge: Certificate signature verified with the issuer's RSA signature scheme
3.7
6 hours ago
node-forge<= 1.4.0
npm: Forge: Incomplete PKCS#7 padding validation in AES/DES CBC and ECB decryption
3.7
6 hours ago
node-forge<= 1.4.0
npm: Forge: X.509 pathLenConstraint not enforced by verifyCertificateChain() for CA certificates without keyUsage
5.9
6 hours ago