High
Exploited in attacks
CVE-2025-54313
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
Low
ghsa-xffm-g5w8-qvg7
@eslint/plugin-kit is vulnerable to Regular Expression Denial of Service attacks through ConfigCommentParser
Medium
CVE-2025-54070
OpenZeppelin Contracts Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers
Low
CVE-2025-7339
on-headers is vulnerable to http response header manipulation
High
CVE-2025-7338
Multer vulnerable to Denial of Service via unhandled exception from malformed request
Medium
CVE-2025-54066
DiracX-Web is vulnerable to attack through an Open Redirect on its login page
Medium
CVE-2025-53892
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes
High
CVE-2025-53818
GitHub Kanban MCP Server vulnerable to Command Injection
Medium
CVE-2025-53889
Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows
Medium
CVE-2025-53887
Directus' exact version number is exposed by the OpenAPI Spec
Medium
CVE-2025-53886
Directus tokens are not redacted in flow logs, exposing session credentials to all admin
Medium
CVE-2025-53885
Directus is vulnerable to sensitive data exposure as user data is not being redacted when logged
Medium
ghsa-hq75-xg7r-rx6c
Better Call routing bug can lead to Cache Deception
Medium
CVE-2025-53626
@pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation
Medium
CVE-2025-53364
Parse Server exposes the data schema via GraphQL API
Critical
CVE-2025-53624
docusaurus-plugin-content-gists vulnerability exposes GitHub Personal Access Token
Critical
CVE-2025-53620
Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests
High
CVE-2025-53548
@clerk/backend Performs Insufficient Verification of Data Authenticity
Critical
CVE-2025-6514
mcp-remote exposed to OS command injection via untrusted MCP server connections
High
CVE-2025-53355
MCP Server Kubernetes vulnerable to command injection in several tools
Medium
CVE-2025-59427
Cloudflare Vite plugin exposes secrets over the built-in dev server
High
CVE-2025-53372
Node.js Sandbox MCP Server vulnerability can lead to Sandbox Escape via Command Injection
Low
CVE-2025-53535
Better Auth Open Redirect Vulnerability in originCheck Middleware Affects Multiple Routes
High
CVE-2025-49826
Next.JS vulnerability can lead to DoS via cache poisoning
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.