Medium
CVE-2025-10649
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,631
Critical
CVE-2025-59159
SillyTavern Web Interface Vulnerable DNS Rebinding
Critical
CVE-2025-52472
XWiki Platform is vulnerable to HQL injection via wiki and space search REST API
Critical
CVE-2025-49594
XWiki OIDC Authenticator: Users with "view" access can create tokens for any users they can view
Critical
CVE-2025-55346
Flowise vulnerable to RCE via Dynamic function constructor injection
Low
CVE-2025-11322
NovoSGA: Manipulation of User Creation Page can lead to weak password requirements
Medium
CVE-2025-12475
Blocksy Companion <= 2.1.14 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-63075
Betheme <= 28.2 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-7400
Featured Image from URL (FIFU) <= 5.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via Featured Image Custom Fields
High
CVE-2025-48082
Progress Planner <= 1.8.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update
Medium
CVE-2025-10645
WP Reset <= 2.05 - Unauthenticated Sensitive Information Exposure via wf-licensing.log
High
CVE-2025-59563
Sonaar <= 4.27.4 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-59560
Sonaar <= 4.27.4 - Reflected Cross-Site Scripting
Medium
CVE-2025-62931
MSN Partner Hub <= 2.8.7 - Missing Authorization
Medium
CVE-2025-62930
MapSVG <= 8.7.23 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2026-28083
Flatsome <= 3.20.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-63072
Cornerstone <= 7.7.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-62932
Table Block by RioVizual <= 3.0.1 - Missing Authorization
Medium
CVE-2025-11287
MCPHub has an Improper Authorization vulnerability via its handleSseConnection function
Low
CVE-2025-11285
MCPHub's ServerController is vulnerable to Command Injection
High
CVE-2025-11277
A weakness has been identified in Open Asset Import Library Assimp 6.0.2. This affects the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. Executing a manipula
High
CVE-2025-11275
A vulnerability was identified in Open Asset Import Library Assimp 6.0.2. Affected by this vulnerability is the function ODDLParser::getNextSeparator in the library assimp/contrib/openddlparser/includ
Medium
CVE-2025-11274
A vulnerability was determined in Open Asset Import Library Assimp 6.0.2. Affected is the function Q3DImporter::InternReadFile of the file assimp/code/AssetLib/Q3D/Q3DLoader.cpp. This manipulation cau
Medium
CVE-2025-62929
Testimonial Slider <= 2.0.15 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.