High
CVE-2025-71375
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 6,861
Reset filters
High
CVE-2025-71372
Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.getlincoef
Medium
CVE-2025-71347
Picklescan is vulnerable to RCE via missing detection when calling numpy.f2py.crackfortran.param_eval
High
CVE-2025-71373
Picklescan is vulnerable to RCE through missing detection when calling built-in python operator.methodcaller
High
CVE-2025-71362
Picklescan missing detection when calling numpy.f2py.crackfortran.getlincoef
High
ghsa-vqmv-47xg-9wpr
Picklescan missing detection when calling pty.spawn
High
ghsa-rcfx-77hg-w2wv
FastMCP updated to MCP 1.23+ due to CVE-2025-66416
Critical
CVE-2025-14931
Hugging Face smolagents: Unsafe deserialization in Remote Python Executor leads to RCE
High
CVE-2025-14930
Hugging Face Transformers GLM4 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of
High
CVE-2025-14928
Hugging Face Transformers HuBERT convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hu
High
CVE-2025-14929
Hugging Face Transformers X-CLIP Checkpoint Conversion Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on af
High
CVE-2025-14926
Hugging Face Transformers SEW convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Huggi
High
CVE-2025-14927
Hugging Face Transformers SEW-D convert_config Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Hug
High
CVE-2025-14920
Hugging Face Transformers Perceiver Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected instal
High
CVE-2025-14921
Hugging Face Transformers Transformer-XL Model Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected i
High
CVE-2025-14924
Hugging Face Transformers megatron_gpt2 Deserialization of Untrusted Data Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installa
High
CVE-2025-68478
External Control of File Name or Path in Langflow
Critical
CVE-2025-68398
Weblate is vulnerable to RCE through Git config file overwrite
High
CVE-2025-63387
Dify v1.9.1 is vulnerable to Insecure Permissions. An unauthenticated attacker can directly send HTTP GET requests to the /console/api/system-features endpoint without any authentication credentials o
Medium
CVE-2024-29370
In python-jose 3.3.0 (specifically jwe.decrypt), a vulnerability allows an attacker to cause a Denial-of-Service (DoS) condition by crafting a malicious JSON Web Encryption (JWE) token with an excepti
Critical
CVE-2025-67895
Apache Airflow Providers Edge3 exposes internal API allowing RCE in web server context
Medium
CVE-2025-67715
Weblate has Systematic User and Project Enumeration via Broken Authorization in REST API (IDOR)
High
CVE-2025-67748
Fickling has Code Injection vulnerability via pty.spawn()
Medium
CVE-2025-67492
Weblate's over‑permissive webhook endpoint enables mass repository updates and component enumeration
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.