High
CVE-2025-32030
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Medium
CVE-2025-71332
FlowiseDB vulnerable to SQL Injection by authenticated users
High
CVE-2025-28269
js-object-utilities Vulnerable to Prototype Pollution
Medium
CVE-2025-31486
Vite allows server.fs.deny to be bypassed with .svg or relative paths
High
CVE-2025-31119
generator-jhipster-entity-audit vulnerable to Unsafe Reflection when having Javers selected as Entity Audit Framework
Critical
CVE-2025-31477
Improper Scope Validation in the `open` Endpoint of `tauri-plugin-shell`
Low
CVE-2025-30218
Next.js may leak x-middleware-subrequest-id to external hosts
High
CVE-2025-71319
image-size Denial of Service via Infinite Loop during Image Processing
High
CVE-2024-38988
@alizeait/unflatto Prototype Pollution
Medium
ghsa-qq4x-c6h6-rfxh
aws-cdk-lib has Insertion of Sensitive Information into Log File vulnerability when using Cognito UserPoolClient Construct
Medium
Exploited in attacks
CVE-2025-31125
Vite has a `server.fs.deny` bypassed for `inline` and `raw` with `?import` query
Medium
CVE-2025-26042
Uptime Kuma's Regular Expression in pushdeeer and whapi file Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
High
CVE-2024-38985
depath and cool-path vulnerable to Prototype Pollution via `set()` Method
Medium
CVE-2025-27793
Vega vulnerable to Cross-site Scripting via RegExp.prototype[@@replace]
High
CVE-2025-30353
Directus's webhook trigger flows can leak sensitive data
Medium
CVE-2025-30352
Directus `search` query parameter allows enumeration of non permitted fields
Low
CVE-2025-30351
Suspended Directus user can continue to use session token to access API
Medium
CVE-2025-30350
Directus's S3 assets become unavailable after a burst of HEAD requests
Medium
CVE-2025-30225
Directus's S3 assets become unavailable after a burst of malformed transformations
Low
CVE-2025-2792
@mozilla/readability Denial of Service through Regex
Medium
CVE-2025-30208
Vite bypasses server.fs.deny when using ?raw??
Low
ghsa-5pq3-h73f-66hr
AWS CDK CodePipeline: trusted entities are too broad
Medium
CVE-2025-2598
AWS CDK CLI prints AWS credentials retrieved by custom credential plugins
Critical
CVE-2025-29927
Authorization Bypass in Next.js Middleware
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.