High
CVE-2025-28269
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,614
Reset filters
Medium
CVE-2025-31476
drupal/tacjs - SA-CONTRIB-2025-027
Medium
CVE-2025-31475
tarteaucitron.js allows prototype pollution via custom text injection
Medium
CVE-2025-31138
tarteaucitron.js allows UI manipulation via unrestricted CSS injection
High
CVE-2025-31119
generator-jhipster-entity-audit vulnerable to Unsafe Reflection when having Javers selected as Entity Audit Framework
Medium
CVE-2025-26042
Uptime Kuma's Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
High
CVE-2024-12905
tar-fs Vulnerable to Link Following and Path Traversal via Extracting a Crafted tar File
Medium
CVE-2025-30352
Directus `search` query parameter allows enumeration of non permitted fields
Medium
CVE-2025-30350
Directus's S3 assets become unavailable after a burst of HEAD requests
Medium
CVE-2025-30225
Directus's S3 assets become unavailable after a burst of malformed transformations
High
CVE-2025-29907
jsPDF Bypass Regular Expression Denial of Service (ReDoS)
Critical
CVE-2025-71338
Flowise allows arbitrary file write to RCE
Critical
CVE-2025-71333
Flowise Pre-auth Arbitrary File Upload
Medium
CVE-2025-27789
Babel has inefficient RegExp complexity in generated code with .replace when transpiling named capturing groups
High
CVE-2025-59049
Mockoon has a Path Traversal and LFI in the static file serving endpoint
Low
CVE-2025-1467
tarteaucitron Cross-site Scripting (XSS)
Medium
CVE-2025-25285
@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
High
CVE-2025-25283
parse-duration has a Regex Denial of Service that results in event loop delay and out of memory
Critical
CVE-2025-24981
Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc
Critical
CVE-2025-24964
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
Low
ghsa-r5w7-f542-q2j4
Potential DoS when using ContextLines integration
Medium
CVE-2025-24360
Opening a malicious website while running a Nuxt dev server could allow read-only access to code
Low
CVE-2024-6533
Directus has a DOM-Based cross-site scripting (XSS) via layout_options
Medium
CVE-2025-29049
MathLive's Lack of Escaping of HTML allows for XSS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.