Medium
CVE-2025-66030
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 559
Reset filters
High
CVE-2025-12816
node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization
High
CVE-2025-64756
glob CLI: Command injection via -c/--cmd executes matches with shell:true
Low
CVE-2025-64745
Astro development server error page is vulnerable to reflected Cross-site Scripting
High
CVE-2025-59840
Vega Cross-Site Scripting (XSS) via expressions abusing toString calls in environments using the VEGA_DEBUG global variable
Medium
CVE-2025-62595
Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic
High
CVE-2025-62427
Angular SSR has a Server-Side Request Forgery (SSRF) flaw
High
ghsa-j44m-5v8f-gc9c
Flowise is vulnerable to arbitrary file exposure through its ReadFileTool
Critical
CVE-2025-61913
Flowise is vulnerable to arbitrary file write through its WriteFileTool
Medium
CVE-2025-13033
Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict
Critical
CVE-2025-55346
Flowise vulnerable to RCE via Dynamic function constructor injection
High
CVE-2025-15061
figma-developer-mcp vulnerable to command injection in get_figma_data tool
Medium
CVE-2025-57354
counterpart vulnerable to prototype pollution
Medium
CVE-2025-59417
Lobe Chat Desktop vulnerable to Remote Code Execution via XSS in Chat Messages
High
CVE-2025-59527
FlowiseAI/Flowise has Server-Side Request Forgery (SSRF) vulnerability
Critical
CVE-2025-57164
FlowiseAI Pre-Auth Arbitrary Code Execution
High
CVE-2025-59041
Claude Code vulnerable to arbitrary code execution caused by maliciously configured git email
High
CVE-2025-58358
mcp-markdownify-server vulnerable to command injection in pptx-to-markdown tool
Critical
CVE-2025-55294
screenshot-desktop vulnerable to command Injection via `format` option
High
CVE-2025-54888
@fedify/fedify has Improper Authentication and Incorrect Authorization
Medium
CVE-2025-54793
Astros's duplicate trailing slash feature leads to an open redirection security issue
High
CVE-2025-54073
mcp-package-docs vulnerable to command injection in several tools
High
CVE-2025-53832
@translated/lara-mcp vulnerable to command injection in import_tmx tool
Medium
CVE-2025-53892
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.