High
CVE-2025-49277
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,690
High
CVE-2025-52815
CityGov <= 1.9 - Unauthenticated Local File Inclusion
Medium
CVE-2025-53021
Moodle Session Fixation allows unauthenticated users to hijack sessions via sesskey parameter
High
CVE-2025-5927
Everest Forms (Pro) <= 1.9.4 - Unauthenticated Path Traversal to Arbitrary File Deletion
Medium
CVE-2025-49147
Umbraco CMS disclosure of configured password requirements
Medium
CVE-2025-5585
SiteOrigin Widgets Bundle <= 1.68.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-url` DOM Element Attribute
High
CVE-2025-52834
Homey <= 2.4.5 - Unauthenticated SQL Injection
Critical
CVE-2025-49448
FW Food Menu <= 6.0.0 - Unauthenticated Arbitrary File Deletion
High
CVE-2025-49886
Zikzag Core <= 1.4.5 - Unauthenticated Local File Inclusion
High
CVE-2025-25171
WP SmartPay <= 2.7.13 - Authenticated (Subscriber+) Account Takeover
Medium
CVE-2025-53286
Dropify <= 4.6.9 - Reflected Cross-Site Scripting
High
CVE-2025-23967
GG Bought Together for WooCommerce <= 1.0.2 - Unauthenticated SQL Injection
High
CVE-2025-53303
ThemeMove Core <= 1.4.2 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2025-60215
Kriya <= 3.4 - Authenticated (Subscriber+) PHP Object Injection
High
CVE-2025-60212
VEDA <= 4.2 - Authenticated (Subscriber+) PHP Object Injection
Critical
CVE-2025-53283
Drop Uploader for CF7 - Drag&Drop File Uploader Addon <= 2.4.1 - Unauthenticated Arbitrary File Upload
High
CVE-2025-53252
Zegen <= 1.1.9 - Authenticated (Subscriber+) Local File Inclusion
Critical
CVE-2025-6547
pbkdf2 silently disregards Uint8Array input, returning static keys
Critical
CVE-2025-6545
pbkdf2 returns predictable uninitialized/zero-filled memory for non-normalized or unimplemented algos
Critical
CVE-2025-2828
A Server-Side Request Forgery (SSRF) vulnerability exists in the RequestsToolkit component of the langchain-community package (specifically, langchain_community.agent_toolkits.openapi.toolkit.Requests
High
CVE-2025-52882
Claude Code Improper Authorization via websocket connections from arbitrary origins
Medium
CVE-2025-49574
Quarkus potentially leaks data when duplicating a duplicated context
Medium
CVE-2025-5258
Conference Scheduler <= 2.5.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via className Parameter
Medium
CVE-2025-52967
gateway_proxy_handler in MLflow before 3.1.0 lacks gateway_path validation.
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.