Medium
CVE-2025-66150
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2025-66153
Headinger for Elementor <= 1.1.4 - Missing Authorization
Medium
CVE-2025-62113
Co-marquage service-public.fr <= 0.5.77 - Cross-Site Request Forgery
Medium
CVE-2025-68867
Effect Maker <= 1.2.1 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2025-62743
MyBookTable Bookstore <= 3.5.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-68950
ImageMagick's failure to limit MVG mutual causes Stack Overflow
Medium
CVE-2025-68618
ImageMagick's failure to limit the depth of SVG file reads caused a DoS attack
Medium
CVE-2025-15284
qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion
High
CVE-2025-69210
FacturaScripts is Vulnerable to Stored Cross-Site Scripting (XSS) via XML File Upload
High
ghsa-6mp4-q625-mxjp
YOURLS is vulnerable to XSS through JSONP and Callback request parameters
High
ghsa-xphh-5v4r-r3rx
PsiTransfer has Zip Slip Path Traversal via TAR Archive Download
Medium
CVE-2025-14783
Easy Digital Downloads <= 3.6.2 - Unvalidated Redirect in Password Reset Flow via edd_redirect
Low
CVE-2025-67746
Composer is vulnerable to ANSI sequence injection
Medium
CVE-2025-69202
axios-cache-interceptor Vulnerable to Cache Poisoning via Ignored HTTP Vary Header
Medium
CVE-2025-69211
Nest has a Fastify URL Encoding Middleware Bypass (TOCTOU)
High
CVE-2025-69200
phpMyFAQ has unauthenticated config backup download via /api/setup/backup
High
CVE-2025-71367
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.attrgetter
High
CVE-2025-71375
Picklescan is vulnerable to RCE via missing detection when calling built-in python _operator.methodcaller
High
CVE-2025-71372
Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef
Low
ghsa-mgr9-6c2j-jxrq
Pterodactyl has a Reflected XSS vulnerability in “Create New Database Host”
Medium
CVE-2026-24958
JetElements For Elementor <= 2.7.12.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-69334
Wishlist for WooCommerce <= 3.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-69038
Hyori <= 1.3.6 - Unauthenticated Local File Inclusion
Medium
CVE-2025-66080
Cookie Notice for GDPR, CCPA & ePrivacy Consent <= 4.0.3 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.