Medium
CVE-2025-48955
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,728
Medium
CVE-2025-48943
vLLM allows clients to crash the openai server with invalid regex
Medium
CVE-2025-48942
vLLM DOS: Remotely kill vllm over http with invalid JSON schema
Medium
CVE-2025-48887
vLLM has a Regular Expression Denial of Service (ReDoS, Exponential Complexity) Vulnerability in `pythonic_tool_parser.py`
Critical
CVE-2025-4607
PSW Front-end Login & Registration <= 1.12 - Insufficiently Random Values to Unauthenticated Account Takeover/Privilege Escalation via customer_registration Function
Medium
CVE-2025-4590
Daisycon prijsvergelijkers <= 4.9.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-4672
Offsprout Page Builder 2.2.1 - 2.15.2 - Authenticated (Contributor+) Privilege Escalation via permission_callback Function
Critical
CVE-2025-4631
Profitori 2.0.6.0 - 2.1.1.3 - Missing Authorization to Unauthenticated Privilege Escalation via stocktend_object Endpoint
Medium
CVE-2025-4595
FastSpring <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-5285
Product Subtitle for WooCommerce <= 1.3.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via htmlTag Parameter
High
CVE-2025-4103
WP-GeoMeta 0.3.4 - 0.3.5 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via wp_ajax_wpgm_start_geojson_import Function
Medium
CVE-2024-7096
WSO2 products vulnerable to privilege escalation due to business logic flaw in SOAP admin services
Medium
CVE-2025-5016
Relevanssi <= 4.24.5 (Free) and <= 2.27.6 (Premium) - Unauthenticated Stored Cross-Site Scripting via Excerpt Highlights
High
CVE-2025-48912
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
CVE-2025-41235
Spring Cloud Gateway Server Forwards Headers from Untrusted Proxies
Medium
CVE-2025-48889
Gradio Allows Unauthorized File Copy via Path Manipulation
Critical
CVE-2025-48330
Real Time Validation for Gravity Forms <= 1.7.0 - Unauthenticated Local File Inclusion
Medium
CVE-2025-49074
WidgetKit <= 2.5.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-48124
Spreadsheet Price Changer for WooCommerce and WP E-commerce – Light <= 2.4.37 - Unauthenticated Arbitrary File Download
High
CVE-2025-31643
WPCHURCH <= 2.7.0 - Authenticated (Subscriber+) Privilege Escalation
Medium
CVE-2025-48328
Real Time Validation for Gravity Forms <= 1.7.0 - Cross-Site Request Forgery
Medium
CVE-2025-49076
The Plus Addons for Elementor Page Builder Lite <= 6.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-3813
Royal Elementor Addons and Templates <= 1.7.1020 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-5292
Element Pack Addons for Elementor – Best Elementor addons with Ready Templates, Blocks, Widgets and WooCommerce Builder <= 5.11.2 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.