Medium
CVE-2025-67554
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
High
CVE-2025-64233
Codiqa < 1.2.8 - Unauthenticated PHP Object Injection
Medium
CVE-2025-64225
Stockie Extra <= 1.2.11 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-64221
Reservation <= 1.6 - Reflected Cross-Site Scripting
High
CVE-2025-11237
Make Email Customizer for WooCommerce <= 1.0.6 - Authenticated (Subscriber+) Arbitrary Options Update
High
CVE-2025-11086
Academy LMS Pro <= 3.3.7 - Unauthenticated Privilege Escalation via Social Login Addon
Medium
CVE-2025-66053
Enfold <= 7.1.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-64201
PowerPress Podcasting <= 11.13.12 - Cross-Site Request Forgery
Medium
CVE-2025-62528
Taguette vulnerable to cross-site scripting via tag name, tag description, document name and document description
High
CVE-2025-62527
Taguette password reset link poisoning
Medium
ghsa-vffh-c9pq-4crh
Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read
Medium
CVE-2025-62522
vite allows server.fs.deny bypass via backslash on Windows
Medium
ghsa-xvp7-8vm8-xfxx
Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers
Low
CVE-2025-57325
rollbar vulnerable to prototype pollution
Medium
CVE-2025-62508
Citizen vulnerable to stored XSS in sticky header button messages
High
CVE-2025-57738
Apache Syncope allows malicious administrators to inject Groovy code
Low
CVE-2025-61417
TastyIgniter vulnerable to Cross-Site Scripting
Medium
CVE-2025-11536
Element Pack Addons for Elementor <= 8.2.5 - Authenticated (Subscriber+) Blind Server-Side Request Forgery
Medium
CVE-2025-62979
ACF to REST API <= 3.3.4 - Unauthenticated Information Exposure
Medium
CVE-2025-62978
KiotViet Sync <= 1.8.5 - Missing Authorization
Medium
CVE-2025-49899
Whydonate <= 4.0.15 - Missing Authorization
Medium
CVE-2026-28044
Rocket <= 3.19.4 - Authenticated (Author+) Stored Cross-Site Scripting
Medium
CVE-2025-49908
WPC Countdown Timer for WooCommerce <= 3.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Unrated
838
Phoca commander
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.