Medium
CVE-2025-29049
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 5,032
Reset filters
Medium
CVE-2025-22150
Use of Insufficiently Random Values in undici
Medium
CVE-2025-24012
XSS/HTML Injection Vulnerability in Umbraco Backoffice Components
Medium
CVE-2025-23221
Infinite loop and Blind SSRF found inside the Webfinger mechanism in @fedify/fedify
Medium
CVE-2025-24010
Websites were able to send any requests to the development server and read the response in vite
Medium
CVE-2025-23207
KaTeX \htmlData does not validate attribute names
Low
CVE-2025-23206
AWS Cloud Development Kit (AWS CDK) IAM OIDC custom resource allows connection to unauthorized OIDC provider
High
CVE-2024-48460
Eugeny Tabby Sends Password Despite Host Key Verification Failure
Medium
CVE-2024-36751
parse-uri Regular expression Denial of Service (ReDoS)
Low
ghsa-m9c9-mc2h-9wjw
Lodestar snappy checksum issue
Low
ghsa-53rv-hcvm-rpp9
Lodestar snappy decompression issue
Medium
CVE-2024-56332
Next.js Allows a Denial of Service (DoS) with Server Actions
High
CVE-2024-56734
Better Auth has an Open Redirect Vulnerability in Verify Email Endpoint
Medium
CVE-2024-56510
Marp Core allows XSS by improper neutralization of HTML sanitization
High
CVE-2024-56334
Systeminformation has command injection vulnerability in getWindowsIEEE8021x (SSID)
Medium
CVE-2024-56331
uptime-kuma vulnerable to Local File Inclusion (LFI) via Improper URL Handling in `Real-Browser` monitor
High
CVE-2024-56159
Astro's server source code is exposed to the public if sourcemaps are enabled
Low
ghsa-m56h-5xx3-2jc2
Prototype pollution in jsii.configureCategories
Medium
CVE-2024-56140
Atro CSRF Middleware Bypass (security.checkOrigin)
Medium
CVE-2024-53866
pnpm no-script global cache poisoning via overrides / `ignore-scripts` evasion
High
CVE-2024-54151
Directus allows unauthenticated access to WebSocket events and operations
Medium
CVE-2024-55565
Predictable results in nanoid generation when given non-integer values
High
CVE-2024-52798
path-to-regexp contains a ReDoS
Medium
CVE-2024-54128
Directus has an HTML Injection in Comment
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.