Critical
ghsa-9qr9-h5gf-34mp
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 1,629
Reset filters
High
CVE-2025-66412
Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes
High
CVE-2025-71401
Better Auth affected by external request basePath modification DoS
High
CVE-2025-14874
Nodemailer’s addressparser is vulnerable to DoS caused by recursive calls
High
CVE-2025-66035
Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client
Medium
CVE-2025-66219
willitmerge has a Command Injection vulnerability
High
CVE-2025-66020
Valibot has a ReDoS vulnerability in `EMOJI_REGEX`
Medium
CVE-2025-65944
Sentry's sensitive headers are leaked when `sendDefaultPii` is set to `true`
Medium
CVE-2025-13437
zx Uses Incorrectly-Resolved Name or Reference
High
CVE-2025-65099
Claude Code vulnerable to command execution prior to startup trust dialog
Medium
CVE-2025-64765
Astro's middleware authentication checks based on url.pathname can be bypassed via url encoded values
High
CVE-2025-64764
Astro vulnerable to reflected XSS via the server islands feature
Low
CVE-2025-64757
Astro Development Server has Arbitrary Local File Read
Medium
CVE-2025-64747
Directus is Vulnerable to Stored Cross-site Scripting
Medium
CVE-2025-64525
Astro vulnerable to URL manipulation via headers, leading to middleware and CVE-2025-61925 bypass
Low
CVE-2025-64745
Astro development server error page is vulnerable to reflected Cross-site Scripting
High
CVE-2025-64496
Open WebUI Affected by an External Model Server (Direct Connections) Code Injection via SSE Events
High
CVE-2025-64495
Open WebUI vulnerable to Stored DOM XSS via prompts when 'Insert Prompt as Rich Text' is enabled resulting in ATO/RCE
Medium
CVE-2025-64118
node-tar has a race condition leading to uninitialized memory exposure
Medium
CVE-2025-62595
Koa Vulnerable to Open Redirect via Trailing Double-Slash (//) in back Redirect Logic
Medium
CVE-2025-62522
vite allows server.fs.deny bypass via backslash on Windows
Medium
ghsa-xvp7-8vm8-xfxx
Actual Sync-server Gocardless service is logging sensitive data including bearer tokens and account numbers
High
CVE-2025-62427
Angular SSR has a Server-Side Request Forgery (SSRF) flaw
High
CVE-2024-56143
Strapi Allows Unauthorized Access to Private Fields via parms.lookup
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.