Critical
CVE-2025-13329
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,632
Medium
CVE-2025-14633
F70 Lead Document Download <= 1.4.4 - Missing Authorization to Unauthenticated Arbitrary Media File Download
High
CVE-2025-66524
Apache NiFi GetAsanaObject Processor has Remote Code Execution via Unsafe Deserialization
Medium
CVE-2025-68390
Elasticsearch privileged authenticated users can cause DoS through Excessive Resource Allocation
Medium
CVE-2025-68384
Elasticsearch has Excessive Allocation of Resources via Submission of Oversized User Settings Data
Medium
CVE-2025-68565
Twitch Player <= 2.1.3 - Missing Authorization
Medium
CVE-2025-68596
Bit Assist <= 1.5.11 - Missing Authorization
Medium
CVE-2025-14803
Nex-Forms Express WP Form Builder <= 9.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting
Critical
CVE-2025-68398
Weblate is vulnerable to RCE through Git config file overwrite
Medium
CVE-2025-68161
Apache Log4j does not verify the TLS hostname in its Socket Appender
Medium
CVE-2025-14455
Image Photo Gallery Final Tiles Grid <= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery Management
Medium
CVE-2025-12361
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure
High
CVE-2025-14151
SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-11747
Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2025-63387
Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials o
Medium
CVE-2025-14761
AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue
High
CVE-2025-68429
Storybook manager bundle may expose environment variables during build
High
CVE-2025-68278
tinacms is vulnerable to arbitrary code execution
Medium
CVE-2025-14449
BA Book Everything <= 1.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via babe-search-form Shortcode
High
CVE-2025-13999
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2025-13754
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-14763
Amazon S3 Encryption Client for Java has a Key Commitment Issue
Medium
CVE-2025-14759
Amazon S3 Encryption Client for .NET has a Key Commitment Issue
Medium
CVE-2023-53929
phpMyFAQ contains a CSV injection vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.