Medium
CVE-2025-68980
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,602
Critical
CVE-2024-56066
Agency Toolkit <= 1.0.23 - Unauthenticated Privilege Escalation
Medium
CVE-2025-68593
Adminify <= 4.0.6.1 - Missing Authorization
Medium
CVE-2025-68981
HomeFix Elementor Portfolio <= 1.0.1 - Missing Authorization
High
CVE-2025-14437
Hummingbird <= 3.18.0 - Unauthenticated Sensitive Information Exposure via Log File
Medium
CVE-2025-14618
Sweet Energy Efficiency <= 1.0.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Graph Deletion
Medium
CVE-2025-14277
Prime Slider – Addons for Elementor <= 4.0.9 - Authenticated (Subscriber+) Server-Side Request Forgery
Medium
CVE-2025-13110
HUSKY – Products Filter Professional for WooCommerce <= 1.3.7.3 - Authenticated (Subscriber+) Insecure Direct Object Reference via 'woof_add_subscr'
Low
CVE-2025-13321
Mattermost Desktop App exposes sensitive information in its application logs
High
CVE-2025-14364
Demo Importer Plus <= 2.0.8 - Missing Authorization to Authenticated (Subscriber+) Site Reset and Privilege Escalation
Medium
ghsa-vvg7-8rmq-92g7
Auth0 WordPress has Improper Audience Validation via Auth0-PHP SDK Dependency
Medium
ghsa-f3r2-88mq-9v4g
Auth0 Symfony SDK has Improper Audience Validation via Auth0-PHP SDK
Medium
ghsa-7hh9-gp72-wh7h
Auth0 Laravel SDK has Improper Audience Validation via Auth0-PHP SDK dependency
Medium
CVE-2025-68129
Auth0-PHP SDK has Improper Audience Validation
Critical
CVE-2025-67165
Pagekit CMS has an Insecure Direct Object Reference (IDOR) in its User Role component
High
CVE-2024-29371
jose4j is vulnerable to DoS via compressed JWE content
Medium
CVE-2024-29370
In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an excepti
Critical
CVE-2025-67164
Pagekit CMS is vulnerable to OS Command Injection via Storage component
Unrated
CVE-2025-14840
drupal/http_client_manager - SA-CONTRIB-2025-126
Medium
CVE-2025-12885
Embed Any Document <= 2.7.10 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2025-67895
Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context
Medium
CVE-2025-13730
OpenID Connect Generic Client <= 3.10.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-13498
Download Manager <= 3.3.32 - Missing Authorization to Authenticated (Subscriber+) Media Attachment Password Disclosure
Medium
CVE-2025-68567
My auctions allegro <= 3.6.33 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.