Medium
CVE-2025-11806
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-11975
FuseWP – WordPress User Sync to Email List & Marketing Automation (Mailchimp, Constant Contact, ActiveCampaign etc.) <= 1.1.23.0 - Missing Authorization to Authenticated (Subscriber+) Sync Rule Creation
Medium
CVE-2025-62503
Apache Airflow's create action can upsert existing Pools/Connections/Variables
Medium
CVE-2025-54941
Apache Airflow has a command injection vulnerability in "example_dag_decorator"
Medium
CVE-2025-62402
Apache Airflow `/api/v2/dagReports` executes DAG Python in API
Medium
CVE-2025-62257
Liferay Portal vulnerable to password enumeration
High
CVE-2025-9954
drupal/acquia_dam - SA-CONTRIB-2025-105
High
CVE-2025-12466
drupal/simple_oauth - SA-CONTRIB-2025-114
Medium
CVE-2025-12083
drupal/civictheme - SA-CONTRIB-2025-113
Medium
CVE-2025-10926
drupal/json_field - SA-CONTRIB-2025-106
Medium
CVE-2025-10930
drupal/currency - SA-CONTRIB-2025-110
Low
CVE-2025-10931
drupal/umami_analytics - SA-CONTRIB-2025-109
Medium
CVE-2025-10928
drupal/access_code - SA-CONTRIB-2025-108
High
CVE-2025-12082
drupal/civictheme - SA-CONTRIB-2025-112
Medium
CVE-2025-10929
drupal/reverse_proxy_header - SA-CONTRIB-2025-111
Medium
CVE-2025-10927
drupal/plausible_tracking - SA-CONTRIB-2025-107
Medium
CVE-2025-64265
Frontend File Manager <= 23.2 - Missing Authorization
High
CVE-2025-12115
WPC Name Your Price for WooCommerce <= 2.1.9 - Unauthenticated Price Alteration
Medium
CVE-2025-8385
Zombify <= 1.7.5 - Authenticated (Subscriber+) Path Traversal to Arbitrary File Read
Medium
CVE-2025-64357
Advanced Database Cleaner <= 3.1.6 - Cross-Site Request Forgery
Medium
CVE-2025-12094
OOPSpam Anti-Spam: Spam Protection for WordPress Forms & Comments (No CAPTCHA) <= 1.2.53 - Unauthenticated IP Header Spoofing
Medium
CVE-2025-12175
The Events Calendar <= 6.15.9 - Missing Authorization to Authenticated (Subscriber+) Draft Event Title/QR Code Exposure
Medium
CVE-2025-64379
Booster for WooCommerce <= 7.4.0 - Missing Authorization
Medium
CVE-2025-10636
NS Maintenance Mode for WP <= 1.3.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.