Medium
CVE-2025-68113
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,003
Reset filters
Medium
CVE-2025-66407
Weblate has a Server-Side Request Forgery issue
High
CVE-2025-67726
Tornado: Quadratic DoS via Crafted Multipart Parameters
High
CVE-2025-67725
Tornado: Quadratic DoS via Repeated Header Coalescing
Critical
CVE-2025-67511
Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool
High
CVE-2025-60455
Modular Max Serve has Unsafe Deserialization vulnerability
Critical
CVE-2025-12762
pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode
High
CVE-2025-64496
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
High
CVE-2025-64495
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Medium
CVE-2025-54941
Apache Airflow has a command injection vulnerability in "example_dag_decorator"
Medium
CVE-2025-62402
Apache Airflow `/api/v2/dagReports` executes DAG Python in API
High
CVE-2025-11201
MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability
High
ghsa-c2jp-c369-7pvx
FastMCP Auth Integration Allows for Confused Deputy Account Takeover
Critical
CVE-2025-62515
pyquokka is Vulnerable to Remote Code Execution by Pickle Deserialization via FlightServer
Critical
CVE-2025-10283
BBOT's insufficient sanitization issues in gitdumper.py can lead to RCE
Critical
CVE-2025-10284
BBOT's various issues in unarchive.py can cause arbitrary file write and RCE
Medium
CVE-2025-61587
Weblate is a web based localization tool. An open redirect exists in versions 5.13.2 and below via the redir parameter on .within.website when Weblate is configured with Anubis and REDIRECT_DOMAINS is
Medium
ghsa-xjv7-6w92-42r7
marimo vulnerable to proxy abuse of /mpl/{port}/
Critical
CVE-2025-6237
InvokeAI has External Control of File Name or Path
Critical
CVE-2025-10156
Picklescan: ZIP archive scan bypass is possible through non-exhaustive Cyclic Redundancy Check
Critical
CVE-2025-10155
Picklescan Bypass is Possible via File Extension Mismatch
Critical
CVE-2025-59377
mcp-kubernetes-server has an OS Command Injection vulnerability
High
CVE-2025-58755
MONAI does not prevent path traversal, potentially leading to arbitrary file writes
Critical
ghsa-58p5-r2f6-g2cj
Pixar OpenUSD Sdf_PathNode Module Use-After-Free Vulnerability Leading to Potential Remote Code Execution
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.