Medium
CVE-2025-14691
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,855
Reset filters
High
CVE-2025-67726
Tornado: Quadratic DoS via Crafted Multipart Parameters
Medium
CVE-2025-67724
Tornado vulnerable to Header Injection and XSS via reason argument
High
CVE-2025-67725
Tornado: Quadratic DoS via Repeated Header Coalescing
Critical
CVE-2025-13780
pgadmin4 has a Meta-Command Filter Command Execution
Critical
CVE-2025-67511
Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool
Critical
CVE-2025-65548
NUT-14 allows cashu tokens to be created with a preimage hash. However, nutshell (cashubtc/nuts) before 0.18.0 do not validate the size of preimage when the token is spent. The preimage is stored by t
High
Exploited in attacks
CVE-2025-34291
Langflow versions up to and including 1.6.9 contain a chained vulnerability that enables account takeover and remote code execution. An overly permissive CORS configuration (allow_origins='*' with all
Low
CVE-2025-63681
open-webui is Vulnerable to Incorrect Access Control
Medium
CVE-2025-64460
Django is vulnerable to DoS via XML serializer text extraction
Medium
CVE-2025-13372
Django is vulnerable to SQL injection in column aliases
Medium
CVE-2025-13742
Emails sent by pretix can utilize placeholders that will be filled with customer data. For example, when {name} is used in an email template, it will be replaced with the buyer's name for the final em
Low
CVE-2025-65681
An issue was discovered in Overhang.IO (tutor-open-edx) (overhangio/tutor) 20.0.2 allowing local unauthorized attackers to gain access to sensitive information due to the absence of proper cache-contr
Low
ghsa-j4gv-6x9v-v23g
OMERO.web uses jquery-form library, which may be vulnerable to XSS attack
High
CVE-2025-13609
A vulnerability has been identified in keylime where an attacker can exploit this flaw by registering a new agent using a different Trusted Platform Module (TPM) device but claiming an existing agent'
Medium
CVE-2025-62609
MLX has Wild Pointer Dereference in load_gguf()
Medium
CVE-2025-62608
MLX has heap-buffer-overflow in load()
Medium
CVE-2025-64521
authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account
High
CVE-2025-60455
Modular Max Serve has Unsafe Deserialization vulnerability
High
CVE-2025-64076
Multiple vulnerabilities exist in cbor2 through version 5.7.0 in the decode_definite_long_string() function of the C extension decoder (source/decoder.c): (1) Integer Underflow Leading to Out-of-Bound
Critical
CVE-2025-55449
AstrBot is vulnerable to RCE with hard-coded JWT signing keys
Critical
CVE-2025-12762
pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode
Medium
CVE-2025-64429
DuckDB is a SQL database management system. DuckDB implemented block-based encryption of DB on the filesystem starting with DuckDB 1.4.0. There are a few issues related to this implementation. The Duc
Low
CVE-2025-63396
An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finalization, leading to a Denial of Service (Do
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.