Critical
ghsa-8g98-m4j9-qww5
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,493
Reset filters
High
CVE-2025-6087
opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass
Critical
CVE-2025-49596
MCP Inspector proxy server lacks authentication between the Inspector client and proxy
High
CVE-2025-49141
HaxCMS-PHP Command Injection Vulnerability
Medium
CVE-2025-49139
@haxtheweb/haxcms-nodejs Iframe Phishing vulnerability
Medium
CVE-2025-48996
Unauthenticated Disclosure of PSU HAX CMS Site Listings via haxPsuUsage API Endpoint
Medium
CVE-2025-30360
webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser
Medium
CVE-2025-30359
webpack-dev-server users' source code may be stolen when they access a malicious web site
Medium
CVE-2025-5276
Markdownify MCP Server allows Server-Side Request Forgery (SSRF) via the Markdownify.get() function
Medium
CVE-2025-5273
Markdownify MCP Server allows attackers to read arbitrary files
Low
CVE-2025-48068
Information exposure in Next.js dev server due to lack of origin verification
Medium
CVE-2024-52588
Strapi allows Server-Side Request Forgery in Webhook function
High
CVE-2025-47935
Multer vulnerable to Denial of Service via memory leaks from unclosed streams
Medium
CVE-2025-4727
Meteor Affected By Inefficient Regular Expression Complexity
Low
CVE-2025-47279
undici Denial of Service attack via bad certificate data
Low
CVE-2025-32421
Next.js Race Condition to Cache Poisoning
Medium
CVE-2025-47828
@lumieducation/h5p-server Fails to Sanitize Plain Text Strings
High
CVE-2025-47269
code-server's session cookie can be extracted by having user visit specially crafted proxy URL
Medium
ghsa-jqx4-9gpq-rppm
@misskey-dev/summaly allows IP Filter Bypass via Redirect
Medium
CVE-2025-4144
@cloudflare/workers-oauth-provider PKCE bypass via downgrade attack
Medium
CVE-2025-4143
@cloudflare/workers-oauth-provider missing validation of redirect_uri on authorize endpoint
Medium
CVE-2025-46565
Vite's server.fs.deny bypassed with /. for files under project root
Medium
CVE-2025-46343
n8n Vulnerable to Stored XSS through Attachments View Endpoint
High
CVE-2025-43865
React Router allows pre-render data spoofing on React-Router framework mode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.