High
CVE-2025-68279
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,406
Low
CVE-2025-68142
PyMdown Extensions has a ReDOS bug in its Figure Capture extension
Medium
CVE-2025-14546
FastAPI SSP is vulnerable to Cross-site Request Forgery (CSRF) through improper OAuth parameter validation
Medium
CVE-2025-34469
Cowrie has a SSRF vulnerability in wget/curl emulation enabling DDoS amplification
Medium
CVE-2025-68463
Biopython is vulnerable to doctype XML external entity (XXE) injection through Bio.Entrez
Medium
CVE-2025-68146
filelock has a TOCTOU race condition which allows symlink attacks during lock file creation
Medium
CVE-2025-68481
FastAPI Users Vulnerable to 1-click Account Takeover in Apps Using FastAPI SSO
High
CVE-2025-53000
nbconvert has an uncontrolled search path that leads to unauthorized code execution on Windows
Medium
CVE-2025-68145
mcp-server-git has missing path validation when using --repository flag
Medium
CVE-2025-68144
mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files
Medium
CVE-2025-68143
mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations
High
CVE-2025-68477
Langflow vulnerable to Server-Side Request Forgery
High
CVE-2025-66471
urllib3 streaming API improperly handles highly compressed data
Medium
CVE-2025-67502
Open Redirect Vulnerability in Taguette
Low
CVE-2025-64725
Weblate has improper validation upon invitation acceptance
High
CVE-2025-14542
Universal Tool Calling Protocol (UTCP) client library for Python vulnerable to Trust Boundary Violation through Manual JSON specification
High
CVE-2025-66418
urllib3 allows an unbounded number of links in the decompression chain
Medium
CVE-2025-67720
Pyrofork has a Path Traversal in download_media Method
High
CVE-2025-65958
Open WebUI vulnerable to Server-Side Request Forgery (SSRF) via Arbitrary URL Processing in /api/v1/retrieval/process/web
High
CVE-2025-67747
Fickling has missing detection for marshal.loads and types.FunctionType in unsafe modules list
Medium
CVE-2025-56427
ComposioHQ has a directory traversal vulnerability
High
CVE-2025-66645
NiceGUI has a path traversal in app.add_media_files() allows arbitrary file read
Medium
CVE-2025-66469
NiceGUI Reflected XSS in ui.add_css, ui.add_scss, and ui.add_sass via Style Injection
Medium
CVE-2025-66470
NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.