Critical
Exploited in attacks
CVE-2025-55182
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,641
Critical
ghsa-9qr9-h5gf-34mp
Next.js is vulnerable to RCE in React flight protocol
Unrated
CVE-2025-13986
drupal/disable_login - SA-CONTRIB-2025-124
Unrated
CVE-2025-13985
drupal/entity_share - SA-CONTRIB-2025-123
Unrated
CVE-2025-13984
drupal/next - SA-CONTRIB-2025-122
Unrated
CVE-2025-13983
drupal/tagify - SA-CONTRIB-2025-121
Unrated
CVE-2025-13982
drupal/login_time_restriction - SA-CONTRIB-2025-120
Unrated
CVE-2025-13981
drupal/ai - SA-CONTRIB-2025-119
Unrated
CVE-2025-13980
drupal/ckeditor5_premium_features - SA-CONTRIB-2025-118
Unrated
CVE-2025-13979
drupal/minisite - SA-CONTRIB-2025-117
Medium
CVE-2025-12826
Custom Post Type UI <= 1.18.0 - Missing Authorization to Unauthenticated (Previously Administrator+) Custom Post Type Modification
Medium
CVE-2025-12782
Beaver Builder – WordPress Page Builder <= 2.9.4 - Missing Authorization to Authenticated (Contributor+) Builder Status Tampering
Medium
CVE-2025-13513
Clik stats <= 0.8 - Reflected Cross-Site Scripting via $_SERVER['PHP_SELF']
Low
CVE-2025-66453
Rhino has high CPU usage and potential DoS when passing specific numbers to `toFixed()` function
High
CVE-2025-66032
Claude Code Command Validation Bypass Allows Arbitrary Code Execution
High
CVE-2025-11727
Omnichannel for WooCommerce: Google, Amazon, eBay & Walmart Integration - Powered by Codisto <= 1.3.65 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-11379
WebP Express <= 0.25.9 - Unauthenticated Information Exposure
High
CVE-2025-66468
Aimeos GrapesJS CMS extension has possible stored XSS that's exploitable by authenticated editors
Medium
CVE-2025-13472
BlazeMeter Jenkins Plugin is Missing Authorization for Available Resources
Medium
CVE-2025-13756
Fluent Booking – The Ultimate Appointments Scheduling, Events Booking, Events Calendar Solution <= 1.9.11 - Authenticated (Subscriber+) Missing Authorization to Calendar Import and Management
Critical
CVE-2025-13390
WP Directory Kit <= 1.4.4 - Authentication Bypass to Privilege Escalation via Account Takeover
Medium
CVE-2025-13401
Autoptimize <= 3.1.13 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-13354
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Taxonomy Term Manipulation
Medium
CVE-2025-13359
Tag, Category, and Taxonomy Manager – AI Autotagger with OpenAI <= 3.40.1 - Authenticated (Contributor+) SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.