Medium
CVE-2025-65019
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-64765
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
High
CVE-2025-64764
Astro vulnerable to reflected XSS via the server islands feature
Low
CVE-2025-64757
Astro Development Server has Arbitrary Local File Read
Medium
CVE-2025-64521
authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account
Medium
CVE-2025-12778
Ultimate Member Widgets for Elementor <= 2.3 - Missing Authorization to Unauthenticated Information Exposure
Critical
CVE-2025-64408
Apache Causeway vulnerable to deserialization in Java
Medium
CVE-2025-12119
MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory
High
CVE-2025-67568
Basel <= 5.9.1 - Missing Authorization
Medium
CVE-2025-13072
HandL UTM Grabber / Tracker <= 2.8.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-5092
Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library
Medium
CVE-2025-13073
HandL UTM Grabber / Tracker <= 2.8.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-67552
Walker Core <= 1.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-60455
Modular Max Serve has Unsafe Deserialization vulnerability
High
CVE-2025-12484
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.19 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-13035
Code Snippets <= 3.9.1 - Authenticated (Contributor+) PHP Code Injection via extract() and PHP Filter Chains
Medium
CVE-2025-65089
XWiki view file macro: User can view content of office file without view rights on the attachment
Medium
CVE-2025-65093
LibreNMS is vulnerable to SQL Injection (Boolean-Based Blind) in hostname parameter in ajax_output.php endpoint
High
CVE-2025-64076
Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-Bound
Medium
CVE-2025-63828
Backdrop CMS Host Header Injection vulnerability
Low
CVE-2025-12761
drupal/simple_multistep - SA-CONTRIB-2025-116
Medium
CVE-2025-12760
drupal/email_tfa - SA-CONTRIB-2025-115
Critical
CVE-2025-12383
Eclipse Jersey has a Race Condition
Low
CVE-2025-65014
LibreNMS has Weak Password Policy
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.