High
CVE-2025-69256
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Medium
CVE-2025-15284
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
High
ghsa-xphh-5v4r-r3rx
PsiTransfer has Zip Slip Path Traversal via TAR Archive Download
Medium
CVE-2025-69202
axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header
Medium
CVE-2025-69211
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
Medium
CVE-2025-69206
hemmelig allows SSRF Filter bypass via Secret Request functionality
Critical
CVE-2025-13158
apidoc-core has a prototype pollution vulnerability
High
CVE-2025-68697
Self-hosted n8n has Legacy Code node that enables arbitrary file read/write
High
CVE-2025-61914
n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox
High
CVE-2025-68665
LangChain serialization injection vulnerability enables secret extraction
High
CVE-2025-68475
Fedify has ReDoS Vulnerability in HTML Parsing Regex
Critical
Exploited in attacks
CVE-2025-68613
n8n Vulnerable to Remote Code Execution via Expression Injection
Low
ghsa-24v3-254g-jv85
Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature
Low
CVE-2025-68457
Orejime has executable code in HTML attributes
High
CVE-2025-68429
Storybook manager bundle may expose environment variables during build
High
CVE-2025-68278
tinacms is vulnerable to arbitrary code execution
Low
CVE-2025-13321
Mattermost Desktop App exposes sensitive information in its application logs
High
CVE-2025-68154
systeminformation has a Command Injection vulnerability in fsSize() function on Windows
High
CVE-2025-68155
@vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint
High
CVE-2025-71399
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits
High
CVE-2025-68130
tRPC has possible prototype pollution in `experimental_nextAppDirCaller`
Medium
CVE-2025-68115
Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables
Medium
CVE-2025-66482
Misskey has a login rate limit bypass via spoofed X-Forwarded-For header
High
CVE-2025-66402
misskey.js's export data contains private post data
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.