Medium
CVE-2025-54070
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 764
Reset filters
Medium
CVE-2025-54066
DiracX-Web is vulnerable to attack through an Open Redirect on its login page
Critical
CVE-2025-53624
docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token
High
CVE-2024-49364
tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment
Low
CVE-2025-6624
Snyk CLI Insertion of Sensitive Information into Log File allowed in DEBUG or DEBUG/TRACE mode
Critical
CVE-2025-6545
pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos
High
CVE-2025-45001
react-native-keys insecurely stores encryption cipher and Base64 chunks
Medium
CVE-2025-30360
webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser
Medium
CVE-2025-30359
webpack-dev-server users' source code may be stolen when they access a malicious web site
High
CVE-2025-48387
tar-fs can extract outside the specified dir with a specific tarball
Medium
CVE-2018-25110
Marked allows Regular Expression Denial of Service (ReDoS) attacks
High
CVE-2025-47934
OpenPGP.js's message signature verification can be spoofed
High
CVE-2025-47269
code-server's session cookie can be extracted by having user visit specially crafted proxy URL
Medium
ghsa-jqx4-9gpq-rppm
@misskey-dev/summaly allows IP Filter Bypass via Redirect
Medium
ghsa-wfm2-rq5g-f8v5
@account-kit/smart-contracts Allowlist Module Bypass Vulnerability
Medium
CVE-2025-32791
Permission policy information leakage in Backstage permission system
Medium
CVE-2025-32388
@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params
Medium
CVE-2025-32395
Vite has an `server.fs.deny` bypass with an invalid `request-target`
Medium
ghsa-qq4x-c6h6-rfxh
aws-cdk-lib has Insertion of Sensitive Information into Log File vulnerability when using Cognito UserPoolClient Construct
Medium
CVE-2025-26042
Uptime Kuma's Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
High
CVE-2024-12905
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File
Medium
CVE-2025-30352
Directus `search` query parameter allows enumeration of non permitted fields
Low
CVE-2025-30351
Suspended Directus user can continue to use session token to access API
Low
CVE-2025-2792
@mozilla/readability Denial of Service through Regex
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.