Critical
CVE-2025-47110
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,741
Medium
CVE-2025-27206
Magento Improper Access Control leads to security feature bypass
High
CVE-2025-49142
Nautobot is a Network Source of Truth and Network Automation Platform. All users of Nautobot versions prior to 2.4.10 or prior to 1.6.32 are potentially affected. Due to insufficient security configur
Medium
CVE-2025-4798
WP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Read
Medium
CVE-2025-4666
ZotPress <= 7.3.15 - Authenticated (Author+) Stored Cross-Site Scripting via 'nickname'
Medium
CVE-2024-40625
Coverage REST API Server Side Request Forgery
Medium
CVE-2024-38524
GWC Home Page communicate version and revision information
Critical
CVE-2024-34711
GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)
High
CVE-2024-29198
GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost
Medium
CVE-2025-27817
Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability
High
CVE-2025-27819
Apache Kafka Deserialization of Untrusted Data vulnerability
High
CVE-2025-27818
Apache Kafka Deserialization of Untrusted Data vulnerability
High
CVE-2025-4799
WP-DownloadManager <= 1.68.10 - Authenticated (Administrator+) Arbitrary File Deletion
Medium
CVE-2025-2799
WP Event Manager <= 3.1.49 - Authenticated (Administrator+) Stored Cross-Site Scripting
High
CVE-2025-3302
Xagio SEO <= 7.1.0.16 - Unauthenticated Stored Cross-Site Scripting via 'HTTP_REFERER'
High
CVE-2025-31919
Spare <= 1.7 - Unauthenticated PHP Object Injection
Critical
CVE-2025-60217
PT Luxa Addons <= 1.2.2 - Authenticated (Subscriber+) Arbitrary File Deletion
High
CVE-2025-5395
WordPress Automatic Plugin - AI content generator and auto poster plugin <= 3.115.0 - Authenticated (Author+) Arbitrary File Upload
Medium
CVE-2025-5144
The Events Calendar <= 6.13.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Critical
CVE-2025-60219
WooCommerce Designer Pro <= 1.9.24 - Unauthenticated Arbitrary File Upload
Critical
CVE-2025-49415
FW Gallery <= 8.0.0 - Unauthenticated Arbitrary File Deletion
High
CVE-2025-4315
CubeWP – All-in-One Dynamic Content Framework <= 1.1.23 - Authenticated (Subscriber+) Privilege Escalation
High
CVE-2025-47579
Photography <= 7.5.2 - Unauthenticated PHP Object Injection
Critical
CVE-2023-45256
Improper neutralization of SQL parameters in Monetico Paiement module from EuroInformation for PrestaShop
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.