Medium
CVE-2025-14984
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
High
CVE-2026-22244
OpenMetadata's Server-Side Template Injection (SSTI) in FreeMarker email templates leads to RCE
Medium
CVE-2026-22242
CoreShop Vulnerable to SQL Injection via Admin Reports
High
CVE-2026-22028
Preact has JSON VNode Injection issue
Medium
CVE-2026-21894
n8n's Missing Stripe-Signature Verification Allows Unauthenticated Forged Webhooks
Critical
CVE-2026-21858
n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling
High
CVE-2025-69264
pnpm v10+ Bypass "Dependency lifecycle scripts execution disabled by default"
High
CVE-2025-69263
pnpm Has Lockfile Integrity Bypass that Allows Remote Dynamic Dependencies
High
CVE-2025-69262
pnpm vulnerable to Command Injection via environment variable substitution
Medium
CVE-2025-13679
Tutor LMS <= 3.9.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via tutor_order_details
Critical
CVE-2025-61492
terminal-controller-mcp vulnerable to Command Injection
High
CVE-2025-67364
fast-filesystem-mcp has a Path Traversal vulnerability
Critical
CVE-2025-12543
Undertow HTTP server core doesn't properly validate the Host header in incoming HTTP requests
Medium
CVE-2025-61782
OpenCTI is an open source platform for managing cyber threat intelligence knowledge and observables. Prior to version 6.8.3, an open redirect vulnerability exists in the OpenCTI platform's SAML authen
Medium
CVE-2025-66560
Quarkus REST has potential worker thread starvation when HTTP connection is closed while waiting to write
Medium
CVE-2025-12640
Folders – Unlimited Folders to Organize Media Library Folder, Pages, Posts, File Manager <= 3.1.5 - Missing Authorization to Authenticated (Author+) Media Replacement
Medium
CVE-2025-14275
Jeg Elementor Kit <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Countdown Widget
Medium
CVE-2025-47500
Stackable <= 3.19.5 - Authenticated (Author+) Stored Cross-Site Scripting
High
CVE-2025-9611
Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools
Low
CVE-2024-14020
carbone Code Injection vulnerability
High
CVE-2025-14431
Navian <= 1.5.4 - Unauthenticated Local File Inclusion
High
CVE-2026-22521
Handmade Framework <= 3.9 - Authenticated (Contributor+) Local File Inclusion
High
CVE-2025-22707
Moody <= 2.7.3 - Unauthenticated Local File Inclusion
Medium
CVE-2026-27094
Page Builder Gutenberg Blocks – CoBlocks <= 3.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.