Medium
ghsa-qq4x-c6h6-rfxh
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
Medium
CVE-2025-31128
drupal/gifplayer - SA-CONTRIB-2025-032
Medium
Exploited in attacks
CVE-2025-31125
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
Medium
CVE-2025-26042
Uptime Kuma's Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
High
CVE-2024-57083
Redoc Prototype Pollution via `Module.mergeObjects` Component
High
CVE-2024-38985
depath and cool-path vulnerable to Prototype Pollution via `set()` Method
High
CVE-2024-12905
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File
Medium
CVE-2025-27793
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
Medium
CVE-2025-26619
Vega Cross-Site Scripting (XSS) via event filter when not using CSP mode expressionInterpeter
High
CVE-2025-30353
Directus's webhook trigger flows can leak sensitive data
Medium
CVE-2025-30352
Directus `search` query parameter allows enumeration of non permitted fields
Low
CVE-2025-30351
Suspended Directus user can continue to use session token to access API
Medium
CVE-2025-30350
Directus's S3 assets become unavailable after a burst of HEAD requests
Medium
CVE-2025-30225
Directus's S3 assets become unavailable after a burst of malformed transformations
Low
CVE-2025-30222
Shescape has potential environment variable exposure on Windows with CMD
Low
CVE-2025-2792
@mozilla/readability Denial of Service through Regex
Medium
CVE-2025-30208
Vite bypasses server.fs.deny when using ?raw??
Low
ghsa-5pq3-h73f-66hr
AWS CDK CodePipeline: trusted entities are too broad
Medium
CVE-2025-2699
GetmeUK ContentTools Cross-Site Scripting (XSS)
High
CVE-2025-2691
nossrf Server-Side Request Forgery (SSRF)
Medium
CVE-2025-2598
AWS CDK CLI prints AWS credentials retrieved by custom credential plugins
Medium
CVE-2025-30168
Parse Server has an OAuth login vulnerability
Critical
CVE-2025-29927
Authorization Bypass in Next.js Middleware
High
ghsa-5ccf-884p-4jjq
Open WebUI Unauthenticated Multipart Boundary Denial of Service (DoS) Vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.