High
CVE-2025-54585
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
High
CVE-2025-54584
GitProxy Backfile Parsing Exploit
High
CVE-2025-54583
GitProxy Approval Bypass When Pushing Multiple Branches
Low
CVE-2025-8129
Koa Open Redirect via Referrer Header (User-Controlled)
Critical
CVE-2025-54419
Node-SAML SAML Signature Verification Vulnerability
Medium
CVE-2025-54590
webfinger.js Blind SSRF Vulnerability
High
CVE-2025-54378
HAX CMS API Lacks Authorization Checks
Critical
CVE-2025-54369
Node-SAML SAML Authentication Bypass
Medium
CVE-2025-54139
HAX CMS application pages vulnerable to clickjacking
High
CVE-2025-54137
NodeJS version of the HAX CMS application is distributed with Default Secrets
High
CVE-2025-54134
HAX CMS NodeJS Application Has Improper Error Handling That Leads to Denial of Service
High
CVE-2025-54128
NodeJS version of HAX CMS Has Disabled Content Security Policy That Enables Cross-Site Scripting
Critical
CVE-2025-54127
NodeJS version of HAX CMS Has Insecure Default Configuration That Leads to Unauthenticated Access
Critical
CVE-2025-7783
form-data uses unsafe random function in form-data for choosing boundary
High
CVE-2025-53832
@translated/lara-mcp vulnerable to command injection in import_tmx tool
High
CVE-2025-54075
Nuxt MDC has an XSS vulnerability in markdown rendering that bypasses HTML filtering
High
Exploited in attacks
CVE-2025-54313
eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code
Low
ghsa-xffm-g5w8-qvg7
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
Medium
CVE-2025-54066
DiracX-Web is vulnerable to attack through an Open Redirect on its login page
Medium
CVE-2025-53892
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes
High
CVE-2025-53818
GitHub Kanban MCP Server vulnerable to Command Injection
Medium
CVE-2025-53889
Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows
Medium
CVE-2025-53886
Directus tokens are not redacted in flow logs, exposing session credentials to all admin
Medium
ghsa-hq75-xg7r-rx6c
Better Call routing bug can lead to Cache Deception
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.