High
CVE-2025-52724
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,686
Medium
CVE-2025-49866
Beautiful Cookie Consent Banner <= 4.6.1 - Reflected Cross-Site Scripting
High
CVE-2025-52831
Video List Manager <= 1.7 - Unauthenticated SQL Injection
High
CVE-2025-49029
Custom Login And Signup Widget <= 1.0 - Authenticated (Administrator+) Remote Code Execution
High
CVE-2025-52729
Diza <= 1.3.9 - Unauthenticated Local File Inclusion
Medium
CVE-2025-5314
Dear Flipbook – PDF Flipbook, 3D Flipbook, PDF embed, PDF viewer <= 2.3.65 - DOM-Based Reflected Cross-Site Scripting via 'pdf-source'
Medium
CVE-2025-6756
Ultra Addons for Contact Form 7 <= 3.5.21 - Authenticated (Contributor+) Stored Cross-Site Scripting via UACF7_CUSTOM_FIELDS Shortcode
High
CVE-2025-53106
Graylog vulnerable to privilege escalation through API tokens
High
CVE-2025-53107
@cyanheads/git-mcp-server vulnerable to command injection in several tools
Medium
CVE-2024-46993
Electron vulnerable to Heap Buffer Overflow in NativeImage
Critical
CVE-2025-6934
Opal Estate Pro <= 1.7.5 - Unauthenticated Privilege Escalation via 'on_regiser_user'
Critical
CVE-2025-26074
Conductor vulnerable to OS command injection through unrestricted access to Java classes
Low
CVE-2025-45143
string-math's string-math.js vulnerability can cause Regex Denial of Service (ReDoS)
High
CVE-2024-46992
electron ASAR Integrity bypass by just modifying the content
High
CVE-2025-53003
Janssen Config API returns results without scope verification
High
CVE-2024-49365
tiny-secp256k1 allows for verify() bypass when running in bundled environment
High
CVE-2024-49364
tiny-secp256k1 vulnerable to private key extraction when signing a malicious JSON-stringifyable message in bundled environment
High
CVE-2025-28980
Aviation Weather from NOAA <= 0.7.2 - Authenticated (Subscriber+) Arbitrary File Deletion
Critical
CVE-2025-49414
FW Gallery <= 8.0.0 - Unauthenticated Arbitrary File Upload
Critical
CVE-2025-30933
LogisticsHub <= 1.1.6 - Unauthenticated Arbitrary File Upload
Medium
CVE-2025-28976
Email Address Security by WebEmailProtector <= 3.3.6 - Authenticated (Subscriber+) Stored Cross-Site Scripting
High
CVE-2025-52833
LMS <= 9.2 - Unauthenticated SQL Injection
Medium
CVE-2025-52813
MobiLoud <= 4.6.6 - Missing Authorization
Medium
CVE-2025-54045
CM On Demand Search And Replace <= 1.5.4 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.