Critical
CVE-2025-6547
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
High
CVE-2025-52882
Claude Code Improper Authorization via websocket connections from arbitrary origins
Critical
ghsa-8g98-m4j9-qww5
Taylored webhook validation vulnerabilities
Medium
CVE-2025-50183
OpenList (frontend) allows XSS Attacks in the built-in Markdown Viewer
High
CVE-2025-6087
opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass
High
CVE-2024-57190
Erxes Incorrect Access Control vulnerability
High
CVE-2025-49141
HaxCMS-PHP Command Injection Vulnerability
High
CVE-2025-45001
react-native-keys insecurely stores encryption cipher and Base64 chunks
Medium
CVE-2025-48996
Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint
Medium
CVE-2025-30360
webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser
Medium
CVE-2025-30359
webpack-dev-server users' source code may be stolen when they access a malicious web site
Critical
CVE-2025-49223
billboard.js allows prototype pollution via the function generate
High
CVE-2025-48387
tar-fs can extract outside the specified dir with a specific tarball
Medium
CVE-2024-52588
Strapi allows Server-Side Request Forgery in Webhook function
High
CVE-2025-47935
Multer vulnerable to Denial of Service via memory leaks from unclosed streams
High
CVE-2025-47934
OpenPGP.js's message signature verification can be spoofed
Medium
CVE-2025-47948
Cocotais Bot has builtin .echo command injection
Medium
CVE-2025-1647
Bootstrap Vulnerable to Cross-Site Scripting in its Popover and Tooltip Components
Low
CVE-2025-47279
undici Denial of Service attack via bad certificate data
Low
CVE-2025-32421
Next.js Race Condition to Cache Poisoning
Medium
CVE-2025-47828
@lumieducation/h5p-server Fails to Sanitize Plain Text Strings
High
CVE-2025-47269
code-server's session cookie can be extracted by having user visit specially crafted proxy URL
High
CVE-2025-46573
Passport-wsfed-saml2 allows SAML Authentication Bypass via Attribute Smuggling
Critical
CVE-2025-46572
Passport-wsfed-saml2 allows SAML Authentication Bypass via Signature Wrapping
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.