Medium
CVE-2025-69300
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2026-25463
Wpresidence Core <= 5.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-24589
Cargus <= 1.5.8 - Unauthenticated Information Exposure
High
CVE-2026-23745
node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization
Critical
CVE-2026-23744
REC in MCPJam inspector due to HTTP Endpoint exposes
High
CVE-2026-23735
GraphQL Modules has a Race Condition issue
Medium
ghsa-38cw-85xc-xr9x
Veramo is Vulnerable to SQL Injection in Veramo Data Store ORM
High
ghsa-gw32-9rmw-qwww
svelte is vulnerable to XSS with textarea bind:value
Medium
CVE-2026-23643
CakePHP PaginatorHelper::limitControl() vulnerable to reflected cross-site-scripting
Medium
CVE-2025-14078
PAYGENT for WooCommerce <= 2.4.6 - Missing Authorization to Unauthenticated Payment Callback Manipulation
Medium
CVE-2026-0725
Integrate Dynamics 365 CRM <= 1.1.1 - Authenticated (Administrator+) Stored Cross-Site Scripting via Field Mapping Configuration
Medium
CVE-2025-8615
CubeWP <= 1.1.26 - Authenticated (Contributor+) Stored Cross-Site Scripting via cubewp_shortcode_taxonomy Shortcode
Medium
CVE-2025-12129
CubeWP – All-in-One Dynamic Content Framework <= 1.1.27 - Unauthenticated Information Exposure
Medium
CVE-2026-0808
Spin Wheel <= 2.1.0 - Unauthenticated Client-Side Prize Manipulation via 'prize_index' Parameter
Medium
CVE-2026-0833
Team Section Block <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Social Network Link
Medium
CVE-2026-23528
Dask Distributed is Vulnerable to Remote Code Execution via Jupyter Proxy and Dashboard
Medium
CVE-2025-14029
Community Events <= 1.5.6 - Missing Authorization to Unauthenticated Arbitrary Event Approval via 'eventlist' Parameter
Medium
CVE-2025-12168
Phrase TMS Integration for WordPress <= 4.7.5 - Missing Authorization to Authenticated (Subscriber+) Log Deletion
Medium
CVE-2025-15104
Nu Html Checker (vnu) contains a Server-Side Request Forgery (SSRF) vulnerability
High
CVE-2025-14894
Livewire Filemanager does not restrict uploaded file types
Medium
CVE-2025-13725
Gutenberg Thim Blocks <= 1.0.1 - Authenticated (Contributor+) Arbitrary File Read via 'iconSVG' Parameter
Low
CVE-2026-0682
Church Admin <= 5.0.28 - Authenticated (Administrator+) Blind Server-Side Request Forgery via 'audio_url' Parameter
Medium
CVE-2025-14463
Payment Button for PayPal <= 1.2.3.41 - Missing Authorization to Unauthenticated Arbitrary Order Creation
Medium
CVE-2026-0820
RepairBuddy <= 4.1116 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Signature Upload to Orders
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.