High
CVE-2025-68665
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 919
Reset filters
High
CVE-2025-68475
Fedify has ReDoS Vulnerability in HTML Parsing Regex
High
CVE-2025-68154
systeminformation has a Command Injection vulnerability in fsSize() function on Windows
Medium
CVE-2025-68113
ALTCHA Proof-of-Work Vulnerable to Challenge Splicing and Replay
High
ghsa-5j59-xgg2-r9c4
Next has a Denial of Service with Server Components - Incomplete Fix Follow-Up
Low
CVE-2025-14284
@tiptap/extension-link vulnerable to Cross-site Scripting (XSS)
Critical
CVE-2025-67489
@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server
High
CVE-2025-65945
auth0/node-jws Improperly Verifies HMAC Signature
High
CVE-2025-66412
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
Critical
CVE-2025-66401
MCP Watch has a Critical Command Injection in cloneRepo allows Remote Code Execution (RCE) via malicious URL
High
CVE-2025-14874
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
Medium
CVE-2025-13466
body-parser is vulnerable to denial of service when url encoding is used
Critical
CVE-2025-65108
md-to-pdf vulnerable to arbitrary JavaScript code execution when parsing front matter
Medium
CVE-2025-65019
Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint
High
CVE-2025-64764
Astro vulnerable to reflected XSS via the server islands feature
Low
CVE-2025-64757
Astro Development Server has Arbitrary Local File Read
High
CVE-2025-64756
glob CLI: Command injection via -c/--cmd executes matches with shell:true
Medium
CVE-2025-64747
Directus is Vulnerable to Stored Cross-site Scripting
Medium
CVE-2025-64525
Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass
Low
CVE-2025-64745
Astro development server error page is vulnerable to reflected Cross-site Scripting
High
CVE-2025-59840
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable
High
CVE-2025-64496
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
High
CVE-2025-64495
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
High
CVE-2025-60542
TypeORM vulnerable to SQL injection via crafted request to repository.save or repository.update
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.