Low
CVE-2025-58751
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,499
Reset filters
Low
CVE-2025-58752
Vite's `server.fs` settings were not applied to HTML files
High
CVE-2025-58444
MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server
Critical
CVE-2025-54994
@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through `exec` API
High
CVE-2025-58179
Server-Side Request Forgery via /_image endpoint in Astro Cloudflare adapter
High
CVE-2025-58358
mcp-markdownify-server vulnerable to command injection in pptx-to-markdown tool
Medium
CVE-2025-57752
Next.js Affected by Cache Key Confusion for Image Optimization API Routes
Medium
CVE-2025-57822
Next.js Improper Middleware Redirect Handling Leads to SSRF
Medium
CVE-2025-9654
AiondaDotCom mcp-ssh command injection vulnerability in SSH operations
High
CVE-2025-58047
Volto affected by possible DoS by invoking specific URL by anonymous user
High
CVE-2025-57820
devalue prototype pollution vulnerability
Medium
CVE-2025-57753
vite-plugin-static-copy files not included in `src` are possible to access with a crafted request
High
ghsa-3j63-5h8p-gf7c
x402 SDK vulnerable in outdated versions in resource servers for builders
Critical
CVE-2025-55746
Directus allows unauthenticated file upload and file modification due to lacking input sanitization
Critical
CVE-2025-55294
screenshot-desktop vulnerable to command Injection via `format` option
Medium
CVE-2025-54881
Mermaid improperly sanitizes sequence diagram labels leading to XSS
Medium
CVE-2025-54880
Mermaid does not properly sanitize architecture diagram iconText leading to XSS
Medium
CVE-2025-55303
Astro allows unauthorized third-party images in _image endpoint
High
CVE-2025-52478
Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source
Low
CVE-2025-55285
Template Secret leakage in logs in Scaffolder when using `fetch:template`
Medium
CVE-2025-55207
@astrojs/node's trailing slash handling causes open redirect issue
Critical
CVE-2025-8943
Flowise OS command remote code execution
High
CVE-2025-55164
content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE
Medium
CVE-2025-55152
Oak Server has ReDoS in x-forwarded-proto and x-forwarded-for headers
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.