High
CVE-2025-58358
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 921
Reset filters
Medium
CVE-2025-4644
Payload's SQLite adapter Session Fixation vulnerability
Medium
CVE-2025-4643
Payload does not invalidate JWTs after log out
High
CVE-2025-50979
NodeBB SQL Injection vulnerability
High
CVE-2025-57820
devalue prototype pollution vulnerability
High
CVE-2025-57810
jsPDF Denial of Service (DoS)
Critical
CVE-2025-9288
sha.js is missing type checks leading to hash rewind and passing on crafted data
Critical
CVE-2025-9287
cipher-base is missing type checks, leading to hash rewind and passing on crafted data
High
CVE-2025-52478
Stored XSS in n8n Form Trigger allows Account Takeover via injected iframe and video/source
Medium
CVE-2025-9096
ExpressGateway Cross-Site Scripting Vulnerability in lib/rest/routes/apps.js
Medium
CVE-2025-55152
Oak Server has ReDoS in x-forwarded-proto and x-forwarded-for headers
High
CVE-2025-54073
mcp-package-docs vulnerable to command injection in several tools
Critical
CVE-2025-54782
@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers
High
CVE-2025-54584
GitProxy Backfile Parsing Exploit
Critical
CVE-2025-7783
form-data uses unsafe random function in form-data for choosing boundary
High
CVE-2025-53832
@translated/lara-mcp vulnerable to command injection in import_tmx tool
Medium
CVE-2025-53892
vue-i18n's escapeParameterHtml does not prevent DOM-based XSS through its tag attributes
High
CVE-2025-53818
GitHub Kanban MCP Server vulnerable to Command Injection
Medium
CVE-2025-53889
Directus' insufficient permission checks can enable unauthenticated users to manually trigger Flows
Medium
CVE-2025-53626
@pdfme/common vulnerable to to XSS and Prototype Pollution through its expression evaluation
Critical
CVE-2025-53620
Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests
High
CVE-2025-53355
MCP Server Kubernetes vulnerable to command injection in several tools
High
CVE-2025-53372
Node.js Sandbox MCP Server vulnerability can lead to Sandbox Escape via Command Injection
Low
CVE-2025-49005
Next.js has a Cache poisoning vulnerability due to omission of the Vary header
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.