High
CVE-2025-2807
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-29480
Buffer Overflow vulnerability in gdal 3.10.2 allows a local attacker to cause a denial of service via the OGRSpatialReference::Release function. NOTE: the Supplier indicates that the report is invalid
High
CVE-2025-3064
WPFront User Role Editor <= 4.2.1 - Cross-Site Request Forgery to Privilege Escalation via whitelist_options Function
Medium
CVE-2025-2882
GreenPay(tm) by Green.Money 3.0.0 - 3.0.9 - Unauthenticated Information Exposure
Medium
CVE-2025-32014
estree-util-value-to-estree allows prototype pollution in generated ESTree
High
CVE-2025-32031
Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Optimization Bypass
High
CVE-2025-32030
Apollo Gateway Query Planner Vulnerable to Excessive Resource Consumption via Named Fragment Expansion
Medium
CVE-2025-71332
FlowiseDB vulnerable to SQL Injection by authenticated users
Medium
CVE-2025-71355
Picklescan failed to detect to some unsafe global function in Numpy library
High
CVE-2025-28269
js-object-utilities Vulnerable to Prototype Pollution
Medium
CVE-2025-31476
drupal/tacjs - SA-CONTRIB-2025-027
Medium
CVE-2025-31475
tarteaucitron.js allows prototype pollution via custom text injection
Medium
CVE-2025-31138
tarteaucitron.js allows UI manipulation via unrestricted CSS injection
Medium
CVE-2025-30373
Graylog's Authenticated HTTP inputs ingest message even if Authorization header is missing or has wrong value
Medium
CVE-2024-13820
Melhor Envio <= 2.15.11 - Unauthenticated Sensitive Information Exposure via Hardcoded Hash
Critical
CVE-2025-2004
Simple WP Events <= 1.8.17 - Unauthenticated Arbitrary File Deletion
Medium
CVE-2025-32244
SEO Help <= 6.8.5 - Missing Authorization
Medium
CVE-2025-32212
Specia Companion <= 4.8 - Missing Authorization
Medium
CVE-2025-32119
CardGate Payments for WooCommerce <= 3.2.1 - Authenticated (Administrator+) SQL Injection
Low
CVE-2025-32205
Piotnet Forms <= 1.0.30 - Authenticated (Editor+) Path Traversal
Medium
CVE-2025-3428
3DPrint Lite <=2.1.3.6 - Authenticated (Admin+) SQL Injection via 'coating_text'
Medium
CVE-2025-3436
coreActivity: Activity Logging for WordPress <= 2.7 - Authenticated (Subscriber+) SQL Injection
Medium
CVE-2025-32128
Nearby Locations <= 1.1.1 - Authenticated (Administrator+) SQL Injection
Medium
CVE-2025-3437
Motors – Car Dealership & Classified Listings Plugin <= 1.4.66 - Missing Authorization to Authenticated (Subscriber+) Wizard Set-up
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.