CVE Search

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-...

Dokku is a docker-powered PaaS. Prior to 0.38.2, the git:auth command creates $DOKKU_ROOT/.netrc using bash's touch command, which applies the default umask of 0644. This pre-creat...

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery (SSRF) vulnerability in the image import functionality allows authenticated users with the can_create_imag...

An Improper Authorization vulnerability exists in PayloadCMS version 3.84.1 due to insufficient access control on the account unlock operation.

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is a DoS vulnerability in ExtractT...

AutoGPT is a workflow automation platform for creating, deploying, and managing continuous artificial intelligence agents. Prior to 0.6.32, there is a DoS vulnerability in AITextSu...

Nil-pointer dereference in CreateCustomVolumeFromBackup in LXD up to version 6.8 and 5.21 on Linux allows an authenticated user with can_create_storage_volumes permissions to cause...

An observable timing discrepancy in the ASP could allow a privileged attacker to perform a brute-force attack against the hash message authentication code, allowing the input of an...

Mattermost Plugins versions <=11.6 10.18.11 11.3.6 11.6.5.0 fail to sanitize error responses from the OpenAI API before logging, which allows a user with access to server logs or s...

Unauthenticated Insecure Direct Object References (IDOR) in GravityView <= 3.0.0 versions.

Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.

Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.

Author Cross Site Scripting (XSS) in Hester Core <= 1.1.8 versions.

Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.

Unauthenticated Insecure Direct Object References (IDOR) in JS Help Desk <= 3.1.0 versions.

Contributor Cross Site Scripting (XSS) in Ghost Kit <= 3.6.0 versions.

Contributor Cross Site Scripting (XSS) in Magazine Blocks <= 1.8.3 versions.

Subscriber Insecure Direct Object References (IDOR) in Majestic Support <= 1.1.7 versions.

Unauthenticated Cross Site Request Forgery (CSRF) in Real Estate 7 <= 3.5.9 versions.

Contributor Cross Site Scripting (XSS) in Fluent Booking <= 2.1.0 versions.