Medium
CVE-2025-39558
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
High
CVE-2025-39533
Starfish Review Generation & Marketing <= 3.1.19 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Medium
CVE-2025-39559
Bring Fraktguiden for WooCommerce <= 1.11.4 - Missing Authorization
Medium
CVE-2025-39552
Zephyr Project Manager <= 3.3.200 - Missing Authorization
Medium
CVE-2025-39577
PropertyHive <= 2.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
ghsa-hf3c-wxg2-49q9
vLLM vulnerable to Denial of Service by abusing xgrammar cache
Medium
CVE-2025-3104
WP Staging Pro <= 6.1.2 - Unauthenticated Information Exposure via getOutdatedPluginsRequest Function
Medium
CVE-2025-3077
Betheme <= 28.0.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-3247
Contact Form 7 <= 6.0.5 - Order Replay Vulnerability
Low
ghsa-qc59-cxj2-c2w4
aws-cdk-lib's aspect order change causes different Permissions Boundary assigned to Role
High
CVE-2025-32021
Weblate is a web based localization tool. Prior to version 5.11, when creating a new component from an existing component that has a source code repository URL specified in settings, this URL is inclu
Medium
CVE-2024-13452
Contact Form by Supsystic <= 1.7.29 - Cross-Site Request Forgery to Stored Cross-Site Scripting via saveAsCopy AJAX Action
Medium
CVE-2025-2314
User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor <= 3.13.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-3573
jquery-validation vulnerable to Cross-site Scripting
Medium
CVE-2025-32997
http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed
Medium
CVE-2025-32996
http-proxy-middleware can call writeBody twice because "else if" is not used
Medium
CVE-2025-26944
JetPopup <= 2.0.11 - Missing Authorization
Medium
CVE-2025-30960
FS Poster <= 6.5.8 - Missing Authorization
Medium
CVE-2025-26996
Sign-up Sheets <= 2.3.0.1 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-32635
Hive Support <= 1.2.6 - Unauthenticated Sensitive Information Exposure
High
CVE-2025-32583
PDF 2 Post <= 2.4.0 - Authenticated (Subscriber+) Remote Code Execution
Critical
CVE-2025-27010
Tastyc < 2.5.2 - Unauthenticated Local File Inclusion
High
CVE-2025-32686
Team Members <= 3.4.4 - Authenticated (Contributor+) PHP Object Injection
Critical
CVE-2025-32572
Kata Plus <= 1.5.3 - Unauthenticated PHP Object Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.