Medium
CVE-2025-9896
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
High
CVE-2025-9816
WP Statistics <= 14.15.4 - Unauthenticated Stored Cross-Site Scripting via User-Agent Header
High
CVE-2025-59845
Apollo Embedded Sandbox and Explorer vulnerable to CSRF via window.postMessage origin-validation bypass
Medium
CVE-2025-59364
express-xss-sanitizer has an unbounded recursion depth
Critical
CVE-2025-59936
get-jwks: poisoned JWKS cache allows post-fetch issuer validation bypass
Medium
CVE-2025-10499
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Plugin Settings Update
Medium
CVE-2025-10498
Ninja Forms – The Contact Form Builder That Grows With You <= 3.12.0 - Cross-Site Request Forgery to Limited File Deletion
Medium
CVE-2025-8440
Team Members <= 5.3.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Low
CVE-2025-1396
WSO2's Input Validation Management Service contains Observable Discrepancy when Multi-Attribute Login is enabled
Medium
CVE-2025-54831
Apache Airflow 3 introduced a change to the handling of sensitive information in Connections. The intent was to restrict access to sensitive connection fields to Connection Editing Users, effectively
High
CVE-2025-56769
Hutool allows remote code execution (RCE) via the QLExpressEngine class
Medium
CVE-2025-60093
Download Manager <= 3.3.24 - Cross-Site Request Forgery
Medium
CVE-2025-60177
Recaptcha – wp <= 0.2.6 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-60116
Grand Conference Theme Custom Post Type < 2.6.4 - Missing Authorization
Medium
CVE-2025-60109
LambertGroup - AllInOne - Content Slider <= 3.8 - Authenticated (Contributor+) SQL Injection
Medium
CVE-2025-60167
Page Manager for Elementor <= 2.0.5 - Authenticated (Subscriber+) Sensitive Information Exposure
Medium
CVE-2025-60096
TheGem (Elementor) <= 5.10.5 - Missing Authorization
Medium
CVE-2025-60120
WP Directory Kit <= 1.4.0 - Missing Authorization
Medium
CVE-2025-60166
WP Subscription Forms PRO <= 2.0.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Deletion
Medium
CVE-2025-60098
Theme My Login <= 7.1.12 - Missing Authorization
Medium
CVE-2025-60148
Subscribe to Download <= 2.0.9 - Missing Authorization
Medium
CVE-2025-60162
Job Board Manager <= 2.1.61 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-60092
Download Manager <= 3.3.25 - Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-60176
WP Tesseract <= 1.0.2 - Authenticated (Administrator+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.