Critical
CVE-2025-13158
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
High
CVE-2025-68697
Self-hosted n8n has Legacy Code node that enables arbitrary file read/write
Critical
CVE-2025-68668
n8n Vulnerable to Arbitrary Command Execution in Pyodide based Python Code Node
High
CVE-2025-61914
n8n's Possible Stored XSS in "Respond to Webhook" Node May Execute Outside iframe Sandbox
High
CVE-2025-25341
libxmljs has segmentation fault, potentially leading to a denial-of-service (DoS)
High
CVE-2025-68665
LangChain serialization injection vulnerability enables secret extraction
High
CVE-2025-68475
Fedify has ReDoS Vulnerability in HTML Parsing Regex
Critical
Exploited in attacks
CVE-2025-68613
n8n Vulnerable to Remote Code Execution via Expression Injection
Low
ghsa-24v3-254g-jv85
Tuta Mail has DOM attribute and CSS injection in its Contact Viewer feature
Low
CVE-2025-68457
Orejime has executable code in HTML attributes
High
CVE-2025-68429
Storybook manager bundle may expose environment variables during build
High
CVE-2025-68278
tinacms is vulnerable to arbitrary code execution
Low
CVE-2025-13321
Mattermost Desktop App exposes sensitive information in its application logs
High
CVE-2025-68154
systeminformation has a Command Injection vulnerability in fsSize() function on Windows
High
CVE-2025-68150
Parse Server is vulnerable to Server-Side Request Forgery (SSRF) via Instagram OAuth Adapter
High
CVE-2025-68155
@vitejs/plugin-rsc has an Arbitrary File Read via `/__vite_rsc_findSourceMapURL` Endpoint
High
CVE-2025-71399
Better Auth's rou3 Dependency has Double-Slash Path Normalization which can Bypass disabledPaths Config and Rate Limits
High
CVE-2025-68130
tRPC has possible prototype pollution in `experimental_nextAppDirCaller`
Medium
CVE-2025-68115
Parse Server has a Cross-Site Scripting (XSS) vulnerability via Unescaped Mustache Template Variables
Medium
CVE-2025-68113
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
Medium
CVE-2025-66482
Misskey has a login rate limit bypass via spoofed X-Forwarded-For header
High
CVE-2025-66402
misskey.js's export data contains private post data
Medium
CVE-2025-67898
MJML allows mj-include directory traversal due to an incomplete fix for CVE-2020-12827
Medium
CVE-2025-8082
Vuetify has a Cross-site Scripting (XSS) vulnerability in the VDatePicker component
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.