Medium
CVE-2025-5896
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
High
CVE-2025-49141
HaxCMS-PHP Command Injection Vulnerability
Medium
CVE-2025-49139
@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability
Medium
CVE-2025-48996
Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint
Medium
CVE-2025-30360
webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser
High
CVE-2025-48387
tar-fs can extract outside the specified dir with a specific tarball
High
CVE-2025-47935
Multer vulnerable to Denial of Service via memory leaks from unclosed streams
Low
CVE-2025-46553
@misskey-dev/summaly Redirect Filter Bypass
Medium
CVE-2025-46565
Vite's server.fs.deny bypassed with /. for files under project root
Medium
ghsa-733v-p3h5-qpq7
GraphQL Armor Cost-Limit Plugin Bypass via Introspection Query Obfuscation
High
CVE-2025-43865
React Router allows pre-render data spoofing on React-Router framework mode
High
CVE-2025-43864
React Router allows a DoS via cache poisoning by forcing SPA mode
High
CVE-2025-43855
tRPC 11 WebSocket DoS Vulnerability
Medium
CVE-2024-47829
pnpm uses the md5 path shortening function causes packet paths to coincide, which causes indirect packet overwriting
Medium
CVE-2025-32395
Vite has an `server.fs.deny` bypass with an invalid `request-target`
High
CVE-2025-28269
js-object-utilities Vulnerable to Prototype Pollution
Medium
CVE-2025-31476
drupal/tacjs - SA-CONTRIB-2025-027
Medium
CVE-2025-31475
tarteaucitron.js allows prototype pollution via custom text injection
Medium
CVE-2025-31138
tarteaucitron.js allows UI manipulation via unrestricted CSS injection
High
CVE-2025-31119
generator-jhipster-entity-audit vulnerable to Unsafe Reflection when having Javers selected as Entity Audit Framework
Medium
CVE-2025-26042
Uptime Kuma's Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
High
CVE-2024-12905
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File
Medium
CVE-2025-30352
Directus `search` query parameter allows enumeration of non permitted fields
Medium
CVE-2025-30350
Directus's S3 assets become unavailable after a burst of HEAD requests
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.