Medium
CVE-2025-30360
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 757
Reset filters
Medium
CVE-2025-30359
webpack-dev-server users' source code may be stolen when they access a malicious web site
High
CVE-2025-48387
tar-fs can extract outside the specified dir with a specific tarball
Medium
CVE-2018-25110
Marked allows Regular Expression Denial of Service (ReDoS) attacks
High
CVE-2025-47934
OpenPGP.js's message signature verification can be spoofed
High
CVE-2025-47269
code-server's session cookie can be extracted by having user visit specially crafted proxy URL
Medium
ghsa-jqx4-9gpq-rppm
@misskey-dev/summaly allows IP Filter Bypass via Redirect
Medium
ghsa-wfm2-rq5g-f8v5
@account-kit/smart-contracts Allowlist Module Bypass Vulnerability
Medium
CVE-2025-32791
Permission policy information leakage in Backstage permission system
Medium
CVE-2025-32388
@sveltejs/kit vulnerable to Cross-site Scripting via tracked search_params
Medium
CVE-2025-32395
Vite has an `server.fs.deny` bypass with an invalid `request-target`
Medium
ghsa-qq4x-c6h6-rfxh
aws-cdk-lib has Insertion of Sensitive Information into Log File vulnerability when using Cognito UserPoolClient Construct
Medium
CVE-2025-26042
Uptime Kuma's Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
High
CVE-2024-12905
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File
Medium
CVE-2025-30352
Directus `search` query parameter allows enumeration of non permitted fields
Low
CVE-2025-30351
Suspended Directus user can continue to use session token to access API
Low
CVE-2025-2792
@mozilla/readability Denial of Service through Regex
Low
ghsa-5pq3-h73f-66hr
AWS CDK CodePipeline: trusted entities are too broad
Medium
CVE-2025-2598
AWS CDK CLI prints AWS credentials retrieved by custom credential plugins
Medium
CVE-2025-30144
Fast-JWT Improperly Validates iss Claims
Critical
CVE-2025-71333
Flowise Pre-auth Arbitrary File Upload
High
CVE-2025-59049
Mockoon has a Path Traversal and LFI in the static file serving endpoint
Medium
CVE-2025-27408
Manifest Uses a One-Way Hash without a Salt
Medium
CVE-2025-25290
@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.