Open Source Vulnerability Database - Patchstack

The leading open source vulnerability database

Instantly mitigate vulnerabilities in WordPress websites with Patchstack.

See pricing

Rated 4.9

Total55,154

MitigationsMitigation rules18,278

No official patch13,656

In triage928

Published soon40

StatsWordPress stats

CVSS0

Mitigation available

Exploited

Affected software \| Vulnerability	Risk	Disclosed
vite-plus>= 1.0.0-rc.0, < 1.3.0 NPM: Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file	6.5	8 hours ago
@vitest/browser>= 5.0.0-beta.6, < 5.0.5 NPM: Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file	6.5	8 hours ago
@vitest/ui>= 5.0.0-beta.6, < 5.0.5 NPM: Vitest: Servers misapply `server.fs.deny`, serving `.env`, private keys, `.git`, and the API token file	6.5	8 hours ago
@vitest/mocker>= 2.1.0-beta.7, < 4.1.12 NPM: Vitest: Code injection via unauthenticated manual mock registration	4.7	8 hours ago
@vitest/mocker>= 4.1.11, < 4.1.12 NPM: Vitest: Windows backslash traversal bypasses the @vitest/mocker redirect allowlist fix	5.9	8 hours ago
@apostrophecms/import-export< 3.7.1 NPM: ApostropheCMS: Exposure of Sensitive Information via predictable export filenames	6	9 hours ago
openclaw< 2026.6.6 NPM: OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs	8.5	9 hours ago
Tailored Tools<= 3.0.3 Cross Site Request Forgery (CSRF) vulnerability	6.5	10 hours ago
H5P<= 1.17.9 Insecure Direct Object References (IDOR) vulnerability	4.3	10 hours ago
eRoom<= 1.7.1 Broken Access Control vulnerability	4.3	10 hours ago
Node.js< 22.23.4 Permission Model Bypass via fs.realpathSync() Path Probing	3.3	11 hours ago
Node.js26.0.0-26.12.0 Permission Model Filesystem Over-Grant via Wildcard Radix Tree Lookup	3.3	11 hours ago
Node.js26.0.0-26.12.0 Exposure of Sensitive Information via Cached Invalid ZIP Local Headers	3.1	11 hours ago
@storybook/addon-mcp>= 10.6.0, < 10.6.2 NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites	9.4	11 hours ago
@storybook/addon-vitest>= 9.0.0, < 9.1.21 NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites	9.4	11 hours ago
@storybook/experimental-addon-test>= 8.0.0, < 8.6.19 NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites	9.4	11 hours ago
@storybook/core-server>= 8.0.0, < 8.6.19 NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites	9.4	11 hours ago
@storybook/core>= 8.0.0, < 8.6.19 NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites	9.4	11 hours ago
storybook>= 8.0.0, < 8.6.19 NPM: Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites	9.4	11 hours ago
electron< 42.11.3 NPM: Electron: HID and USB permission checks can be attributed to the wrong origin	5.4	11 hours ago

Sunbelt Computer Software

PL/B Language Development and Support

The leading open source vulnerability database