Medium
CVE-2025-54881
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
Medium
CVE-2025-54880
Mermaid does not properly sanitize architecture diagram iconText leading to XSS
Medium
CVE-2025-55303
Astro allows unauthorized third-party images in _image endpoint
High
CVE-2025-52478
Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source
High
CVE-2025-55284
Claude Code's Permissive Default Allowlist Enables Unauthorized File Read and Network Exfiltration in Claude Code
Medium
CVE-2025-9096
ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/apps.js
Medium
CVE-2025-9095
ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/users.js
Low
CVE-2025-55285
Template Secret leakage in logs in Scaffolder when using `fetch:template`
Medium
CVE-2025-55207
@astrojs/node's trailing slash handling causes open redirect issue
Critical
CVE-2025-8943
Flowise OS command remote code execution
High
CVE-2025-55164
content-security-policy-parser Prototype Pollution Vulnerability May Lead to RCE
Medium
CVE-2025-55152
Oak Server has ReDoS in x-forwarded-proto and x-forwarded-for headers
Low
ghsa-xcxh-6cv4-q8p8
HFS user adding a "web link" in HFS is vulnerable to "target=_blank" exploit
High
CVE-2025-55009
The AuthKit Remix Library renders sensitive auth data in HTML
High
CVE-2025-55008
The AuthKit React Router Library rendered sensitive auth data in HTML
High
CVE-2025-54888
@fedify/fedify has Improper Authentication and Incorrect Authorization
Medium
CVE-2025-54793
Astros's duplicate trailing slash feature leads to an open redirection security issue
Medium
CVE-2025-54885
The Thinbus Javascript Secure Remote Password (SRP) Client Generates Fewer Bits of Entropy Than Intended
Low
CVE-2025-54798
tmp allows arbitrary temporary file / directory write via symbolic link `dir` parameter
High
CVE-2025-54073
mcp-package-docs vulnerable to command injection in several tools
High
CVE-2025-54803
js-toml Prototype Pollution Vulnerability
High
CVE-2025-54795
Claude Code echo command allowed bypass of user approval prompt for command execution
High
CVE-2025-54794
Claude Code Research Preview has a Path Restriction Bypass which could allow unauthorized file access
Medium
CVE-2025-54387
IPX Allows Path Traversal via Prefix Matching Bypass
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.