Medium
CVE-2025-23221
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,614
Reset filters
Medium
CVE-2025-24010
Websites were able to send any requests to the development server and read the response in vite
Low
ghsa-m9c9-mc2h-9wjw
Lodestar snappy checksum issue
Low
ghsa-53rv-hcvm-rpp9
Lodestar snappy decompression issue
High
CVE-2024-56734
Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint
Low
ghsa-m56h-5xx3-2jc2
Prototype pollution in jsii.configureCategories
High
CVE-2024-54151
Directus allows unauthenticated access to WebSocket events and operations
Medium
CVE-2024-53843
@dapperduckling/keycloak-connector-server has Reflected XSS Vulnerability in Authentication Flow URL Handling
High
CVE-2024-32965
@lobehub/chat Server Side Request Forgery vulnerability
High
CVE-2024-58351
Flowise OverrideConfig security vulnerability
Low
CVE-2024-21539
Regular Expression Denial of Service (ReDoS) in @eslint/plugin-kit
High
CVE-2024-49770
Path traversal in oak allows transfer of hidden files within the served root directory
High
CVE-2024-48930
secp256k1-node allows private key extraction over ECDH
Low
CVE-2024-9506
ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function
Medium
CVE-2024-47831
Denial of Service condition in Next.js image optimization
High
CVE-2024-47818
Saltcorn Server allows logged-in users to delete arbitrary files because of a path traversal vulnerability
High
CVE-2024-47183
Parse Server's custom object ID allows to acquire role privileges
High
ghsa-78p3-fwcq-62c2
@saltcorn/server Remote Code Execution (RCE) / SQL injection via prototype pollution by manipulating `lang` and `defstring` parameters when setting localizer strings
Medium
ghsa-cfqx-f43m-vfh7
@saltcorn/server arbitrary file and directory listing when accessing build mobile app results
Medium
ghsa-277h-px4m-62q8
@saltcorn/server arbitrary file zip read and download when downloading auto backups
Medium
ghsa-593m-55hh-j8gv
Sentry SDK Prototype Pollution gadget in JavaScript SDKs
Critical
CVE-2024-47169
Agnai vulnerable to Remote Code Execution via JS Upload using Directory Traversal
Medium
CVE-2024-45613
Cross-site scripting (XSS) in the clipboard package
High
CVE-2024-47068
DOM Clobbering Gadget found in rollup bundled scripts that leads to XSS
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.