High
CVE-2025-27152
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,493
Reset filters
Medium
CVE-2025-27143
Beter Auth has an Open Redirect via Scheme-Less Callback Parameter
Medium
CVE-2025-25290
@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
Medium
CVE-2025-25289
@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
Medium
CVE-2024-57177
CouchAuth has a Server-Side Template Injection vulnerability in its email functionality
Medium
ghsa-67mh-4wv8-2f99
esbuild enables any website to send any requests to the development server and read the response
Critical
CVE-2025-24964
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
Medium
CVE-2025-24963
Vitest browser mode serves arbitrary files
Low
ghsa-r5w7-f542-q2j4
Potential DoS when using ContextLines integration
Medium
CVE-2025-24361
Opening a malicious website while running a Nuxt dev server could allow read-only access to code
Medium
CVE-2025-24360
Opening a malicious website while running a Nuxt dev server could allow read-only access to code
Low
CVE-2024-6533
Directus has a DOM-Based cross-site scripting (XSS) via layout_options
Medium
CVE-2025-22150
Use of Insufficiently Random Values in undici
Medium
CVE-2025-23221
Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify
Medium
CVE-2025-24010
Websites were able to send any requests to the development server and read the response in vite
High
CVE-2024-48460
Eugeny Tabby Sends Password Despite Host Key Verification Failure
Low
ghsa-53rv-hcvm-rpp9
Lodestar snappy decompression issue
Medium
CVE-2024-56332
Next.js Allows a Denial of Service (DoS) with Server Actions
Medium
CVE-2024-56331
uptime-kuma vulnerable to Local File Inclusion (LFI) via Improper URL Handling in `Real-Browser` monitor
High
CVE-2024-56159
Astro's server source code is exposed to the public if sourcemaps are enabled
Medium
CVE-2024-56140
Atro CSRF Middleware Bypass (security.checkOrigin)
High
CVE-2024-54151
Directus allows unauthenticated access to WebSocket events and operations
High
CVE-2024-54134
Modified package published to npm, containing malware that exfiltrates private key material
Medium
CVE-2024-53983
Backstage Scaffolder plugin vulnerable to Server-Side Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.