Critical
CVE-2025-0855
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-3853
WPshop 2 – E-Commerce 2.0.0 - 2.6.0 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary User Key Generation
Critical
CVE-2025-45616
BRCC Incorrect Access Control vulnerability
Medium
CVE-2025-29573
Cross-Site Scripting (XSS) vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module.
Medium
CVE-2025-46734
league/commonmark contains a XSS vulnerability in Attributes extension
Medium
CVE-2025-3782
Cision Block <= 4.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via id Parameter
High
CVE-2025-2011
Slider & Popup Builder by Depicter <= 3.6.1 - Unauthenticated SQL Injection via 's' Parameter
High
CVE-2025-46731
Craft CMS Contains a Potential Remote Code Execution Vulnerability via Twig SSTI
Low
CVE-2025-46720
Keystone has an unintended `isFilterable` bypass that can be used as an oracle to match hidden fields
Critical
CVE-2025-47241
Browser Use allows bypassing `allowed_domains` by putting a decoy domain in http auth username portion of a URL
Critical
CVE-2025-24977
OpenCTI is an open cyber threat intelligence (CTI) platform. Prior to version 6.4.11 any user with the capability `manage customizations` can execute commands on the underlying infrastructure where Op
Low
CVE-2025-46553
@misskey-dev/summaly Redirect Filter Bypass
High
CVE-2025-2802
LayoutBoxx <= 0.3.1 - Unauthenticated Arbitrary Shortcode Execution
Medium
CVE-2025-4337
AHAthat Plugin <= 1.6 - Cross-Site Request Forgery to AHA Page Deletion
Low
CVE-2024-51991
October CMS Allows Unprotected SVG Rename in Media Manager
High
CVE-2025-3610
Reales WP STPT <= 2.1.2 - Authenticated (Subscriber+) Privilege Escalation via Password Update
Critical
CVE-2025-2905
WSO2 API Manager XML External Entity (XXE) vulnerability
Medium
CVE-2025-3609
Reales WP STPT <= 2.1.2 - Unauthorized User Registration
High
CVE-2025-4279
External image replace <= 1.0.8 - Authenticated (Contributor+) Arbitrary File Upload
High
CVE-2025-60221
Captivate Sync <= 3.0.3 - Unauthenticated PHP Object Injection
Critical
CVE-2025-1909
BuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider
Medium
CVE-2025-3281
User Registration & Membership – Custom Registration Form, Login Form, and User Profile <= 4.2.1 - Insecure Direct Object Reference to Unauthenticated Limited User Deletion
Medium
CVE-2024-11615
Envolve Plugin <= 1.0 - Unauthenticated Language File Deletion
Medium
CVE-2025-47226
Grokability Snipe-IT has incorrect authorization for accessing asset information
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.