Medium
CVE-2025-65513
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,493
Reset filters
Critical
CVE-2025-67489
@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server
High
CVE-2025-65959
Open WebUI Vulnerable to Stored DOM XSS via Note 'Download PDF'
Medium
CVE-2025-66404
mcp-server-kubernetes has potential security issue in exec_in_pod tool
Critical
ghsa-fmh4-wr37-44fp
React Server Components are Vulnerable to RCE
Critical
Exploited in attacks
CVE-2025-55182
React Server Components are Vulnerable to RCE
Critical
ghsa-9qr9-h5gf-34mp
Next.js is vulnerable to RCE in React flight protocol
High
CVE-2025-66414
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
Medium
CVE-2025-66405
Portkey.ai Gateway: Server-Side Request Forgery (SSRF) in Custom Host
Critical
CVE-2025-66401
MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL
High
CVE-2025-71401
Better Auth affected by external request basePath modification DoS
High
CVE-2025-14874
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
High
CVE-2025-66031
node-forge has ASN.1 Unbounded Recursion
High
CVE-2025-12816
node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization
High
CVE-2025-66020
Valibot has a ReDoS vulnerability in `EMOJI_REGEX`
Medium
CVE-2025-66028
OneUptime is Vulnerable to Privilege Escalation via Login Response Manipulation
Medium
CVE-2025-65944
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`
High
CVE-2025-64762
authkit-nextjs may let session cookies be cached in CDNs
Medium
CVE-2025-65019
Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint
Medium
CVE-2025-64765
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
High
CVE-2025-64764
Astro vulnerable to reflected XSS via the server islands feature
Low
CVE-2025-64757
Astro Development Server has Arbitrary Local File Read
High
CVE-2025-64756
glob CLI: Command injection via -c/--cmd executes matches with shell:true
Medium
CVE-2025-64718
js-yaml has prototype pollution in merge (<<)
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.