Critical
CVE-2025-55746
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Medium
CVE-2025-50864
elysia-cors Origin Validation Error
Critical
CVE-2025-55294
screenshot-desktop vulnerable to command Injection via `format` option
Medium
CVE-2025-54881
Mermaid improperly sanitizes sequence diagram labels leading to XSS
Medium
CVE-2025-54880
Mermaid does not properly sanitize architecture diagram iconText leading to XSS
Medium
CVE-2025-55303
Astro allows unauthorized third-party images in _image endpoint
High
CVE-2025-52478
Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source
High
CVE-2025-55284
Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Code
Medium
CVE-2025-9096
ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/apps.js
Low
CVE-2025-55285
Template Secret leakage in logs in Scaffolder when using `fetch:template`
Medium
CVE-2025-55207
@astrojs/node's trailing slash handling causes open redirect issue
Medium
CVE-2025-55152
Oak Server has ReDoS in x-forwarded-proto and x-forwarded-for headers
Low
ghsa-xcxh-6cv4-q8p8
HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit
High
CVE-2025-54888
@fedify/fedify has Improper Authentication and Incorrect Authorization
Medium
CVE-2025-54793
Astros's duplicate trailing slash feature leads to an open redirection security issue
Low
CVE-2025-54798
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter
High
CVE-2025-54073
mcp-package-docs vulnerable to command injection in several tools
High
CVE-2025-54803
js-toml Prototype Pollution Vulnerability
High
CVE-2025-54795
Claude Code echo command allowed bypass of user approval prompt for command execution
High
CVE-2025-54794
Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access
Medium
CVE-2025-54387
IPX Allows Path Traversal via Prefix Matching Bypass
Critical
CVE-2025-54782
@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers
High
CVE-2025-34146
@nyariv/sandboxjs has Prototype Pollution vulnerability that may lead to RCE
High
CVE-2025-54586
GitProxy Hidden Commits Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.