Medium
CVE-2025-27089
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Medium
CVE-2025-25290
@octokit/request has a Regular Expression in fetchWrapper that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
Medium
CVE-2025-25289
@octokit/request-error has a Regular Expression in index that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
Medium
CVE-2025-25288
@octokit/plugin-paginate-rest has a Regular Expression in iterator Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
Medium
CVE-2025-25285
@octokit/endpoint has a Regular Expression in parse that Leads to ReDoS Vulnerability Due to Catastrophic Backtracking
Medium
CVE-2025-25304
Vega allows Cross-site Scripting via the vlSelectionTuples function
Critical
ghsa-vjh7-7g9h-fjfh
Elliptic's private key extraction in ECDSA upon signing a malformed input (e.g. a string)
High
CVE-2025-25283
parse-duration has a Regex Denial of Service that results in event loop delay and out of memory
Medium
CVE-2024-57177
CouchAuth has a Server-Side Template Injection vulnerability in its email functionality
Medium
CVE-2024-11831
Cross-site Scripting (XSS) in serialize-javascript
Medium
ghsa-67mh-4wv8-2f99
esbuild enables any website to send any requests to the development server and read the response
Critical
CVE-2025-24981
Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc
Critical
CVE-2024-57077
utils-extend Prototype Pollution
High
CVE-2024-57075
eazy-logger prototype pollution
Medium
CVE-2025-71404
Better Auth URL parameter HTML Injection (Reflected Cross-Site scripting)
Critical
CVE-2025-24964
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
Medium
CVE-2025-24963
Vitest browser mode serves arbitrary files
Medium
CVE-2024-53615
files.photo.gallery command injection
Medium
CVE-2025-24791
snowflake-sdk may incorrectly validate temporary credential cache file permissions
Low
ghsa-r5w7-f542-q2j4
Potential DoS when using ContextLines integration
Medium
CVE-2025-24361
Opening a malicious website while running a Nuxt dev server could allow read-only access to code
Medium
CVE-2025-24360
Opening a malicious website while running a Nuxt dev server could allow read-only access to code
Low
CVE-2024-6533
Directus has a DOM-Based cross-site scripting (XSS) via layout_options
Medium
CVE-2025-24353
Directus allows privilege escalation using Share feature
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.