Medium
CVE-2025-54387
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
Critical
CVE-2025-54782
@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers
High
CVE-2025-54586
GitProxy Hidden Commits Injection
High
CVE-2025-54585
GitProxy New Branch Approval Exploit
High
CVE-2025-54584
GitProxy Backfile Parsing Exploit
Low
CVE-2025-8129
Koa Open Redirect via Referrer Header (User-Controlled)
Medium
CVE-2025-54590
webfinger.js Blind SSRF Vulnerability
High
CVE-2025-54378
HAX CMS API Lacks Authorization Checks
Medium
CVE-2025-54139
HAX CMS application pages vulnerable to clickjacking
High
CVE-2025-54134
HAX CMS NodeJS Application Has Improper Error Handling That Leads to Denial of Service
Critical
CVE-2025-7783
form-data uses unsafe random function in form-data for choosing boundary
High
CVE-2025-54075
Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering
Low
ghsa-xffm-g5w8-qvg7
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
Critical
CVE-2025-53620
Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests
High
CVE-2025-53548
@clerk/backend Performs Insufficient Verification of Data Authenticity
High
CVE-2025-53355
MCP Server Kubernetes vulnerable to command injection in several tools
Medium
CVE-2025-59427
Cloudflare Vite plugin exposes secrets over the built-in dev server
Low
CVE-2025-53535
Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes
Medium
CVE-2025-48939
tarteaucitron.js vulnerable to DOM Clobbering via document.currentScript
High
CVE-2025-53107
@cyanheads/git-mcp-server vulnerable to command injection in several tools
Medium
CVE-2025-52573
iOS Simulator MCP Command Injection allowed via exec API
Critical
CVE-2025-6545
pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos
High
CVE-2025-52882
Claude Code Improper Authorization via websocket connections from arbitrary origins
Critical
ghsa-8g98-m4j9-qww5
Taylored webhook validation vulnerabilities
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.