Medium
CVE-2024-10761
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-24011
Umbraco Allows User Enumeration Feasible Based On Management API Timing and Response Codes
Medium
CVE-2025-29049
MathLive's Lack of Escaping of HTML allows for XSS
Medium
CVE-2025-24013
Missing validation of header name and value in codeigniter4/framework
Medium
CVE-2025-22150
Use of Insufficiently Random Values in undici
Medium
CVE-2025-22131
Cross-Site Scripting (XSS) vulnerability in generateNavigation() function in PhpSpreadsheet
High
CVE-2025-24019
Authenticated arbitrary file deletion in YesWiki
High
CVE-2025-24018
Authenticated Stored XSS in YesWiki
High
CVE-2025-24017
Unauthenticated DOM Based XSS in YesWiki
Medium
CVE-2025-24012
XSS/HTML Injection Vulnerability in Umbraco Backoffice Components
Medium
CVE-2025-23221
Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify
Medium
CVE-2025-24010
Websites were able to send any requests to the development server and read the response in vite
High
Exploited in attacks
CVE-2025-23209
Craft CMS has a potential RCE with a compromised security key
High
CVE-2024-53829
Cross-Site Request Forgery in CodeChecker API
Medium
CVE-2024-13590
Ketchup Shortcodes <= 0.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2024-13426
WP-Polls <= 2.77.2 - Unauthenticated SQL Injection to Stored Cross-Site Scripting
High
CVE-2025-23184
Apache CXF: Denial of Service vulnerability with temporary files
Medium
CVE-2024-43709
Elasticsearch allocation of resources without limits or throttling leads to crash
Medium
CVE-2024-13543
Zarinpal Paid Downloads <= 2.3 - Reflected Cross-Site Scripting
Medium
CVE-2024-12117
Stackable – Page Builder Gutenberg Blocks <= 3.13.11 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-0429
AI Power: Complete AI Pack <= 1.8.96 - Authenticated (Admin+) PHP Object Injection via wpaicg_export_ai_forms
High
CVE-2025-24671
Save as PDF Plugin by Pdfcrowd <= 4.4.0 - Unauthenticated PHP Object Injection
Medium
CVE-2025-22702
Photography <= 7.5.2 - Missing Authorization
Medium
CVE-2024-12879
WPBot Pro Wordpress Chatbot <= 13.5.5 - Missing Authorization to Authenticated (Subscriber+) Simple Text Response Creation
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.