High
CVE-2025-6220
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,741
High
CVE-2025-6086
CSV Me <= 2.0 - Authenticated (Administrator+) Arbitrary File Upload
Medium
CVE-2025-5237
Target Video Easy Publish <= 3.8.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via width Parameter
Critical
Exploited in attacks
CVE-2025-3248
Langflow Unauth RCE
Critical
CVE-2025-1562
Recover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit <= 3.5.3 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation
High
CVE-2025-4413
Pixabay Images <= 3.4 - Authenticated (Author+) Arbitrary File Upload
Medium
CVE-2025-6050
Mezzanine CMS has a Stored Cross-Site Scripting (XSS) vulnerability in the displayable_links_js function
Critical
CVE-2025-6167
A vulnerability classified as critical has been found in themanojdesai python-a2a up to 0.5.5. Affected is the function create_workflow of the file python_a2a/agent_flow/server/api.py. The manipulatio
Medium
CVE-2025-15656
School Management <= 93.2.0 - Authenticated (Support Staff+) Privilege Escalation
Medium
CVE-2025-39486
Rankie - Wordpress Rank Tracker Plugin < 1.8.2 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-5291
Master Slider <= 3.10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via masterslider_pb and ms_slide Shortcodes
Medium
CVE-2025-5700
Simple Logo Carousel <= 1.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
High
CVE-2025-3515
Drag and Drop Multiple File Upload for Contact Form 7 <= 1.3.8.9 - Unauthenticated Arbitrary File Upload via Insufficient Blacklist Checks
High
CVE-2025-6087
opennextjs-cloudflare has SSRF vulnerability via /cdn-cgi/ path normalization bypass
Medium
CVE-2025-48945
pycares has a Use-After-Free Vulnerability
Medium
CVE-2025-49125
Apache Tomcat - Security constraint bypass for pre/post-resources
High
CVE-2025-48988
Apache Tomcat - DoS in multipart upload
High
CVE-2025-48976
Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers
Medium
CVE-2025-49124
Apache Tomcat installer for Windows has an untrusted search path vulnerability
High
CVE-2025-3594
Liferay Portal path traversal vulnerability with the downloading and installation of Xuggler
High
CVE-2025-3526
Liferay Portal SessionClicks does not restrict the saving of request parameters in the HTTP session
High
CVE-2025-3602
Liferay Portal does not limit the depth of a GraphQL queries
Medium
CVE-2025-5673
Blog2Social <= 8.4.4 - Authenticated (Subscriber+) SQL Injection via `prgSortPostType` Parameter
High
CVE-2025-3774
Wise Chat <= 3.3.4 - Unauthenticated Stored Cross-Site Scripting via X-Forwarded-For Header
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.