High
CVE-2025-9890
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-11256
Kognetiks Chatbot <= 2.3.5 - Missing Authorization to Unauthenticated Limited File Uploads and Conversation Erasing
Medium
CVE-2025-10750
PowerBI Embed Reports <= 1.2.0 - Unauthenticated Sensitive Information Disclosure
Medium
CVE-2025-11372
LearnPress – WordPress LMS Plugin <= 4.2.9.3 - Missing Authorization to Unauthenticated Database Table Manipulation
Critical
CVE-2025-49655
Keras framework vulnerable to deserialization of untrusted data
Medium
CVE-2025-11741
WPC Smart Quick View for WooCommerce <= 4.2.5 - Insecure Direct Object Reference to Unauthenticated Private Product Exposure
Medium
CVE-2025-11510
FileBird <= 6.4.9 - Improper Authorization to Authenticated (Author+) Settings Reset
Medium
CVE-2025-10006
WPBakery Page Builder <= 8.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-11691
PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated SQL Injection
An unauthenticated SQL injection vulnerability in PPOM for WooCommerce allows attackers to extract sensitive database information when Legacy Price Calculations are enabled.
Critical
CVE-2025-11391
PPOM – Product Addons & Custom Fields for WooCommerce <= 33.0.15 - Unauthenticated Arbitrary File Upload
A vulnerability in PPOM – Product Addons & Custom Fields for WooCommerce allows unauthenticated attackers to upload arbitrary files via the image cropper, potentially enabling remote code execution on sites with the paid version active.
Critical
CVE-2025-62515
pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer
High
CVE-2025-11517
Event Tickets and Registration <= 5.26.5 - Unauthenticated Ticket Payment Bypass
Medium
ghsa-8c2g-f8jm-5cr7
ibexa/fieldtype-richtext has an XSS vulnerability via acronym custom tag in Rich Text
Medium
CVE-2025-11519
Image optimization service by Optimole <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Media Offload
Medium
ghsa-2mx6-fq24-g2mh
ibexa/admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal
Medium
ghsa-99c7-c3mw-mxhv
ezsystems/ezplatform-admin-ui has an XSS vulnerability in Cancel/Reschedule future publication modal
Medium
ghsa-q3x8-6898-23g3
ibexa/user login enumerates user accounts
Medium
CVE-2025-11703
WP Go Maps (formerly WP Google Maps) <= 9.0.48 - Unauthenticated Cache Poisoning
Medium
CVE-2025-9562
Redirection for Contact Form 7 <= 3.2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via qs_date Shortcode
Low
CVE-2025-62505
Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module
Medium
CVE-2025-10044
Keycloak error_description injection on error pages that can trigger phishing attacks
Medium
CVE-2025-11738
Media Library Assistant <= 3.29 - Unauthenticated Limited File Read
Medium
CVE-2025-11361
Essential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery
Medium
CVE-2025-11378
ShortPixel Image Optimizer <= 6.3.4 - Authenticated (Contributor+) Settings Import/Export
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.