Medium
CVE-2025-53467
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,632
Medium
CVE-2025-58029
Classic Widgets with Block-based Widgets <= 1.0.1 - Missing Authorization
Medium
CVE-2025-60208
Advanced Custom Fields : CPT Options Pages <= 2.0.9 - Cross-Site Request Forgery
High
CVE-2025-64266
Booking and Rental Manager <= 2.5.4 - Authenticated (Contributor+) PHP Object Injection
High
CVE-2025-53428
Simple User Registration <= 6.4 - Authenticated (Contributor+) Privilege Escalation
High
CVE-2025-53425
Dokan <= 4.1.3 - Authenticated (Shop Manager+) Privilege Escalation
Medium
CVE-2025-53426
Likert Survey Master <= 0.8.0.1 - Reflected Cross-Site Scripting
Medium
CVE-2025-53427
SEO Pyramid <= 1.10.0 - Reflected Cross-Site Scripting
Medium
CVE-2025-43808
Liferay Portal Commerce component has Incorrect Permission Assignment for Critical Resource
Medium
CVE-2025-43809
Liferay Portal Cross-Site Request Forgery (CSRF) vulnerability
Medium
CVE-2025-43803
Liferay Contacts Center widget has insecure direct object reference
Medium
CVE-2025-9882
osTicket WP Bridge <= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-9887
Custom Login And Signup Widget <= 1.0 - Cross-Site Request Forgery
Medium
CVE-2025-9883
Browser Sniff <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
High
CVE-2025-59532
Codex has sandbox bypass due to bug in path configuration logic
Medium
CVE-2025-10002
ClickWhale <= 2.5.0 - Authenticated (Admin+) SQL injection
Medium
CVE-2025-10652
Robcore Netatmo <= 1.7 - Authenticated (Contributor+) SQL Injection via robcore-netatmo Shortcode
High
CVE-2025-9906
Keras is vulnerable to Deserialization of Untrusted Data
High
CVE-2025-9905
The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.
Medium
CVE-2025-59717
@digitalocean/do-markdownit has Type Confusion vulnerability
Medium
CVE-2025-59713
Snipe-IT allows unsafe deserialization
Medium
CVE-2025-59712
Snipe-IT allows XSS
High
CVE-2025-7665
Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation
Medium
CVE-2025-9949
Internal Links Manager <= 3.0.1 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.