High
CVE-2025-60542
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,523
Reset filters
Medium
ghsa-5jpx-9hw9-2fx4
NextAuthjs Email misdelivery Vulnerability
High
CVE-2025-59837
Astro's bypass of image proxy domain validation leads to SSRF and potential XSS
Medium
CVE-2025-71381
Hono vulnerable to Vary Header Injection leading to potential CORS Bypass
Medium
CVE-2025-62517
rollbar vulnerable to Prototype Pollution in merge()
High
CVE-2025-62713
Kottster app reinitialization can be re-triggered allowing command injection in development mode
High
CVE-2025-62610
Hono Improper Authorization vulnerability
Medium
CVE-2025-62595
Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic
Medium
ghsa-vffh-c9pq-4crh
Uptime Kuma Server-side Template Injection (SSTI) in Notification Templates Allows Arbitrary File Read
Medium
CVE-2025-62522
vite allows server.fs.deny bypass via backslash on Windows
Medium
ghsa-xvp7-8vm8-xfxx
Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers
Low
CVE-2025-57325
rollbar vulnerable to prototype pollution
Low
CVE-2025-62505
Lobe Chat vulnerable to Server-Side Request Forgery with native web fetch module
Critical
CVE-2025-11849
Mammoth is vulnerable to Directory Traversal
High
CVE-2025-62427
Angular SSR has a Server-Side Request Forgery (SSRF) flaw
High
CVE-2025-53092
Strapi core vulnerable to sensitive data exposure via CORS misconfiguration
Medium
CVE-2025-25298
Strapi Password Hashing is Missing Maximum Password Length Validation
High
CVE-2024-56143
Strapi Allows Unauthorized Access to Private Fields via parms.lookup
Medium
CVE-2025-3930
Strapi is vulnerable to Insufficient Session Expiration
Critical
CVE-2025-62410
happy-dom's `--disallow-code-generation-from-strings` is not sufficient for isolating untrusted JavaScript
High
CVE-2025-62381
`sveltekit-superforms` has Prototype Pollution in `parseFormData` function of `formData.js`
Low
CVE-2025-62380
Mailgen has HTML Injection and XSS Filter Bypass in Plaintext Emails
Medium
CVE-2025-62374
Parse Javascript SDK vulnerable to prototype pollution in `Parse.Object` and internal APIs
High
CVE-2025-34267
Flowise: Authenticated Command Execution and Sandbox Bypass via Puppeteer and Playwright Packages
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.