High
ghsa-xphh-5v4r-r3rx
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,616
Medium
CVE-2025-14783
Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect
Low
CVE-2025-67746
Composer is vulnerable to ANSI sequence injection
Medium
CVE-2025-69202
axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header
Medium
CVE-2025-69211
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
High
CVE-2025-69200
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
High
CVE-2025-71367
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter
High
CVE-2025-71375
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller
High
CVE-2025-71372
Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef
Low
ghsa-mgr9-6c2j-jxrq
Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”
Medium
CVE-2026-24958
JetElements For Elementor <= 2.7.12.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-69334
Wishlist for WooCommerce <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-69038
Hyori <= 1.3.6 - Unauthenticated Local File Inclusion
Medium
CVE-2025-66080
Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.0.3 - Missing Authorization
Medium
CVE-2025-68528
Free Shipping Bar: Amount Left for Free Shipping for WooCommerce <= 2.4.9 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-63027
WBC907 Core <= 3.4.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-52835
WING WordPress Migrator <= 1.2.0 - Cross-Site Request Forgery
High
CVE-2025-69042
Lindo <= 1.2.5 - Unauthenticated Local File Inclusion
Medium
CVE-2025-69089
Auto Listings <= 2.7.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62112
Import into Easy Property Listings <= 2.2.1 - Cross-Site Request Forgery
Medium
CVE-2025-68502
JetPopup <= 2.0.20.1 - Authenticated (Contributor+) Insecure Direct Object Reference
Medium
CVE-2026-22349
Menu In Post <= 1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-69037
Pippo <= 1.2.3 - Unauthenticated Local File Inclusion
Medium
CVE-2026-22353
teachPress <= 9.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.