Medium
CVE-2025-68596
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Medium
CVE-2025-14803
Nex-Forms Express WP Form Builder <= 9.1.7 - Authenticated (Admin+) Stored Cross-Site Scripting
Critical
CVE-2025-68398
Weblate is vulnerable to RCE through Git config file overwrite
Medium
CVE-2025-68161
Apache Log4j does not verify the TLS hostname in its Socket Appender
Medium
CVE-2025-14455
Image Photo Gallery Final Tiles Grid <= 3.6.7 - Missing Authorization to Authenticated (Contributor+) Gallery Management
Medium
CVE-2025-12361
myCred – Points Management System For Gamification, Ranks, Badges, and Loyalty Program <= 2.9.7.1 - Missing Authorization to Sensitive Information Exposure
High
CVE-2025-14151
SlimStat Analytics <= 5.3.2 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-11747
Colibri Page Builder <= 1.0.345 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
High
CVE-2025-63387
Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials o
Medium
CVE-2025-14761
AWS SDK for PHP's S3 Encryption Client has a Key Commitment Issue
High
CVE-2025-68429
Storybook manager bundle may expose environment variables during build
High
CVE-2025-68278
tinacms is vulnerable to arbitrary code execution
Medium
CVE-2025-14449
BA Book Everything <= 1.8.14 - Authenticated (Contributor+) Stored Cross-Site Scripting via babe-search-form Shortcode
High
CVE-2025-13999
HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player 2.4.0 - 2.5.1 - Unauthenticated Server-Side Request Forgery
Medium
CVE-2025-13754
Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin <= 1.6.9.16 - Missing Authorization to Unauthenticated Sensitive Information Exposure
Medium
CVE-2025-14763
Amazon S3 Encryption Client for Java has a Key Commitment Issue
Medium
CVE-2025-14759
Amazon S3 Encryption Client for .NET has a Key Commitment Issue
Medium
CVE-2023-53929
phpMyFAQ contains a CSV injection vulnerability
Medium
CVE-2025-68592
Adminify <= 4.0.6.1 - Missing Authorization
Medium
CVE-2025-68979
Google Calendar Events <= 3.5.9 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2026-23548
DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.25 - Missing Authorization
Medium
CVE-2025-68982
DesignThemes LMS Addon <= 2.6 - Missing Authorization
Medium
CVE-2025-67622
Evergreen Post Tweeter <= 1.8.9 - Cross-Site Request Forgery
Medium
CVE-2026-27387
DirectoryPress – Business Directory And Classified Ad Listing <= 3.6.26 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.