Critical
CVE-2025-64087
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Critical
CVE-2025-65482
XDocReport affected by an XML External Entity (XXE) vulnerability
Critical
CVE-2026-23733
Lobe Chat affected by Cross-Site Scripting(XSS) that can escalate to Remote Code Execution(RCE)
Medium
CVE-2026-22770
ImageMagick releases an invalid pointer in BilateralBlur when memory allocation fails
Low
CVE-2026-23522
Lobe Chat has IDOR in Knowledge Base File Removal that Allows Cross User File Deletion
Medium
CVE-2026-23626
Kimai has an Authenticated Server-Side Template Injection (SSTI)
High
CVE-2026-22037
@fastify/express vulnerable to Improper Handling of URL Encoding (Hex Encoding)
High
CVE-2026-22031
Fastify Middie Middleware Path Bypass
Medium
CVE-2025-69198
Pterodactyl improperly locks resources allowing raced queries to create more resources than alloted
Medium
CVE-2026-1180
Keycloak’s OpenID Connect Dynamic Client Registration feature affected by Server-Side Request Forgery (SSRF)
Critical
CVE-2025-15521
Academy LMS – WordPress LMS Plugin for Complete eLearning Solution <= 3.5.0 - Unauthenticated Privilege Escalation via Account Takeover
Low
CVE-2026-1195
MineAdmin improperly refreshes tokens
Low
CVE-2026-1196
MineAdmin May Expose Sensitive Information to an Unauthorized Actor
Medium
CVE-2026-0690
FlatPM – Ad Manager, AdSense and Custom Code <= 3.2.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Post Meta
Medium
CVE-2026-0608
Head Meta Data <= 20251118 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Meta
High
CVE-2026-0726
Nexter Extension – Site Enhancements Toolkit <= 4.4.6 - Unauthenticated PHP Object Injection via 'nxt_unserialize_replace'
Medium
CVE-2026-0554
NotificationX <= 3.1.11 - Missing Authorization to Authenticated (Contributor+) Analytics Reset
High
CVE-2025-15380
NotificationX <= 3.2.0 - Unauthenticated DOM-Based Cross-Site Scripting via 'nx-preview'
High
CVE-2025-15347
Creator LMS – The LMS for Creators, Coaches, and Trainers <= 1.1.12 - Missing Authorization to Authenticated (Contributor+) Arbitrary Options Update
Medium
CVE-2026-0548
Tutor LMS – eLearning and online course solution <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Limited Attachment Deletion
Medium
CVE-2025-15043
The Events Calendar <= 6.15.13 - Missing Authorization to Authenticated (Subscriber+) Data Migration Control
Medium
CVE-2026-1194
MineAdmin May Expose Sensitive Information to an Unauthorized Actor
Low
CVE-2026-1193
MineAdmin has Incorrect Privilege Assignment
Medium
CVE-2026-22218
Chainlit versions prior to 2.9.4 contain an arbitrary file read vulnerability in the /project/element update flow. An authenticated client can send a custom Element with a user-controlled path value,
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.