Medium
CVE-2025-53662
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-53654
Jenkins Statistics Gatherer Plugin vulnerability exposes AWS Secret Key
Medium
CVE-2025-53653
Jenkins Aqua Security Scanner Plugin vulnerability exposes scanner tokens
Medium
CVE-2025-53652
Jenkins Git Parameter Plugin vulnerable to code injection due to inexhaustive parameter check
Medium
CVE-2025-53651
Jenkins HTML Publisher Plugin vulnerability displays controller file system information in its logs
Medium
CVE-2025-53650
Jenkins Credentials Binding Plugin vulnerability can expose sensitive information in logger messages
Critical
CVE-2025-53620
Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests
High
CVE-2025-53548
@clerk/backend Performs Insufficient Verification of Data Authenticity
Unrated
CVE-2025-7393
drupal/mail_login - SA-CONTRIB-2025-088
Unrated
CVE-2025-7392
drupal/cookies_addons - SA-CONTRIB-2025-087
Critical
CVE-2025-6514
mcp-remote exposed to OS command injection via untrusted MCP server connections
Medium
CVE-2025-5807
Gwolle Guestbook <= 4.9.2 - Unauthenticated Stored Cross-Site Scripting via `gwolle_gb_content` Parameter
Medium
CVE-2025-4406
wpForo Forum <= 2.4.5 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Profile Avatar
Medium
CVE-2025-6976
Events Manager <= 7.0.3 - Authenticated(Contributor+) Stored Cross-Site Scripting via Plugin Shortcodes
High
CVE-2025-6970
Events Manager <= 7.0.3 - Unauthenticated SQL Injection via `orderby` Parameter
Medium
CVE-2025-6975
Event Manager <= 7.0.3 - Reflected Cross-Site Scripting via `calendar_header` Parameter
Medium
CVE-2025-49948
Super Edit <= 2.5.4 - Reflected Cross-Site Scripting
Medium
CVE-2025-7387
Lana Downloads Manager <= 1.10.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Medium
CVE-2025-49949
Templazee <= 1.0.2 - Missing Authorization
High
CVE-2025-53355
MCP Server Kubernetes vulnerable to command injection in several tools
Medium
CVE-2025-59427
Cloudflare Vite plugin exposes secrets over the built-in dev server
High
CVE-2025-6691
SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated Arbitrary File Deletion Triggered via Administrator Submission Deletion
High
CVE-2025-6742
SureForms – Drag and Drop Form Builder for WordPress <= 1.7.3 - Unauthenticated PHP Object Injection (PHAR) Triggered via Admin Submission Deletion
High
CVE-2025-53372
Node.js Sandbox MCP Server vulnerability can lead to Sandbox Escape via Command Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.