Medium
CVE-2025-10039
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Medium
CVE-2025-12747
Tainacan <= 1.0.0 - Unauthenticated Information Exposure
High
CVE-2025-12160
Simple User Registration <= 6.6 - Unauthenticated Stored Cross-Site Scripting
Medium
CVE-2025-12935
FluentCRM - Marketing Automation For WordPress <= 2.9.84 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'fluentcrm_content' Shortcode
Medium
CVE-2025-66113
Better Chat Support for Messenger <= 1.2.18 - Missing Authorization
Medium
CVE-2025-66104
Offload, AI & Optimize with Cloudflare Images <= 1.9.5 - Missing Authorization
Medium
CVE-2025-10054
ELEX WordPress HelpDesk & Customer Ticketing System <= 3.3.1 - Missing Authorization to Authenticated (Subscriber+) Role Removal
High
CVE-2025-65103
OpenSTAManager has Authenticated SQL Injection in API via 'display' parameter
High
CVE-2025-65099
Claude Code vulnerable to command execution prior to startup trust dialog
Medium
CVE-2025-65019
Astro Cloudflare adapter has Stored Cross-site Scripting vulnerability in /_image endpoint
Medium
CVE-2025-64765
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
High
CVE-2025-64764
Astro vulnerable to reflected XSS via the server islands feature
Low
CVE-2025-64757
Astro Development Server has Arbitrary Local File Read
Medium
CVE-2025-64521
authentik is an open-source Identity Provider. Prior to versions 2025.8.5 and 2025.10.2, when authenticating with client_id and client_secret to an OAuth provider, authentik creates a service account
Medium
CVE-2025-12778
Ultimate Member Widgets for Elementor <= 2.3 - Missing Authorization to Unauthenticated Information Exposure
Critical
CVE-2025-64408
Apache Causeway vulnerable to deserialization in Java
Medium
CVE-2025-12119
MongoDB driver extension affected by mongoc_bulk_operation_t's read of invalid memory
High
CVE-2025-67568
Basel <= 5.9.1 - Missing Authorization
Medium
CVE-2025-13072
HandL UTM Grabber / Tracker <= 2.8.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-5092
Multiple Plugins and Themes <= (Various Versions) - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via lightGallery JavaScript Library
Medium
CVE-2025-13073
HandL UTM Grabber / Tracker <= 2.8.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-67552
Walker Core <= 1.3.17 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-60455
Modular Max Serve has Unsafe Deserialization vulnerability
High
CVE-2025-12484
Giveaways and Contests by RafflePress – Get More Website Traffic, Email Subscribers, and Social Followers <= 1.12.19 - Unauthenticated Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.