Critical
CVE-2025-26534
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,609
Critical
CVE-2025-26900
Flexmls® IDX <= 3.14.27 - Unauthenticated PHP Object Injection
Medium
CVE-2025-26884
Greenshift <= 10.8 - Authenticated (Contributor+) Stored Cross-Site Scripting
High
CVE-2025-26885
Assistant <= 1.5.1 - Authenticated (Editor+) PHP Object Injection
Medium
CVE-2025-26878
Autoship Cloud for WooCommerce Subscription Products <= 2.8.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-26879
s2Member Pro <= 241216 - Reflected Cross-Site Scripting
Low
ghsa-f679-254h-qhvj
Leantime allows Cross-Site Scripting (XSS)
Medium
CVE-2025-28254
Leantime affected by Improper Neutralization of HTML Tags
Low
ghsa-3hfj-qcvj-4hx8
Leantime has Missing Authorization Check for Host Parameter
High
ghsa-c39w-3pjx-qc7m
Leantime allows Stored Cross-Site Scripting (XSS)
Medium
ghsa-92xh-6x7v-4rmq
Leantime allows Cross-Site Request Forgery (CSRF)
High
ghsa-v4q9-437p-mhpg
Leantime allows Cross Site Scripting (XSS) and SQL Injection (SQLi)
Medium
ghsa-63cr-xg3f-8jvr
Leantime allows Stored Cross-Site Scripting (XSS)
Medium
ghsa-52xf-h226-pfgx
Leantime allows Refelected Cross-Site Scripting (XSS)
Medium
ghsa-h6w8-27ph-c385
Leantime has Insufficiently Protected Credentials
Low
CVE-2025-26622
Vyper's sqrt doesn't define rounding behavior
Low
CVE-2025-27105
AugAssign evaluation order causing OOB write within the object in Vyper
Low
CVE-2025-27104
Vyper has a double eval in For List Iter
Medium
ghsa-mg4c-884j-pcq9
Leantime allows Stored Cross-Site Scripting (XSS)
Medium
ghsa-99r5-84gr-59f6
Leantime has Host Header Injection Vulnerability
High
CVE-2025-1403
Malciously crafted QPY files can allows Remote Attackers to Cause Denial of Service in Qiskit
High
CVE-2025-1361
IP2Location Country Blocker <= 2.38.8 - Missing Authorization to Unauthenticated Information Exposure via admin_init Function
Medium
CVE-2024-13564
Rife Elementor Extensions & Templates <= 1.2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via Writing Effect Headline Shortcode
High
CVE-2024-13474
LTL Freight Quotes – Purolator Edition <= 2.2.3 - Unauthenticated SQL Injection
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.