High
CVE-2025-62381
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
Low
CVE-2025-62380
Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails
Low
CVE-2025-62366
Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails
High
CVE-2025-59288
Playwright downloads and installs browsers without verifying the authenticity of the SSL certificate
High
ghsa-j44m-5v8f-gc9c
Flowise is vulnerable to arbitrary file exposure through its ReadFileTool
High
CVE-2025-61928
Better Auth: Unauthenticated API key creation through api-key plugin
High
CVE-2025-71380
n8n: Execute Command Node Allows Authenticated Users to Run Arbitrary Commands on Host
Critical
CVE-2025-61913
Flowise is vulnerable to arbitrary file write through its WriteFileTool
High
CVE-2025-61687
FlowiseAI/Flosise has File Upload vulnerability
Medium
CVE-2025-13033
Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict
High
CVE-2025-59536
Claude Code can execute commands prior to the startup trust dialog
Low
CVE-2025-56514
Fiora chat user avatar is vulnerable to XSS via SVG files
Low
CVE-2025-56515
Fiora chat group avatar is vulnerable to XSS via SVG files
High
CVE-2025-61668
@plone/volto vulnerable to potential DoS by invoking specific URL by anonymous user
Critical
CVE-2025-59936
get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass
Critical
CVE-2020-36851
cors-anywhere vulnerable to server-side request forgery
Medium
CVE-2025-61685
Mastra Docs MCP Server `@mastra/mcp-docs-server` Leads to Information Exposure
High
CVE-2025-59343
tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball
High
CVE-2025-59430
Mesh Connect JS SDK Vulnerable to Cross Site Scripting via createLink.openLink
Medium
CVE-2025-59526
Mailgen: HTML injection vulnerability in plaintext e-mails
High
CVE-2025-59532
Codex has sandbox bypass due to bug in path configuration logic
High
CVE-2025-59333
@executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode
High
CVE-2025-59331
is-arrayish@0.3.3 contains malware after npm account takeover
High
CVE-2025-59330
error-ex@1.3.3 contains malware after npm account takeover
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.