Medium
CVE-2025-66147
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,632
Critical
CVE-2025-67511
Cybersecurity AI (CAI) vulnerable to Command Injection in run_ssh_command_with_credentials Agent tool
Critical
CVE-2025-14307
Robocode has an insecure temporary file creation vulnerability in the AutoExtract component
Critical
CVE-2025-14306
Robocode vulnerable to Directory Traversal in recursivelyDelete Method
Low
CVE-2025-14284
@tiptap/extension-link vulnerable to Cross-site Scripting (XSS)
Medium
CVE-2025-13877
Authentication Bypass via Default JWT Secret in NocoBase docker-compose Deployments
High
CVE-2025-67648
Shopware Storefront Reflected XSS in Storefront Login Page
Critical
ghsa-5j8p-438x-rgg5
SAML PHP Toolkit Vulnerability on xmlseclibs CVE-2025-66475
Medium
ghsa-93fv-4pm9-xp28
JDA (Java Discord API) downloads external URLs when updating message components
Critical
CVE-2025-67510
Neuron MySQLWriteTool allows arbitrary/destructive SQL when exposed to untrusted prompts (agent “footgun”)
High
CVE-2025-67509
Neuron MySQLSelectTool “read-only” bypass via `SELECT ... INTO OUTFILE` (file write → potential RCE)
High
CVE-2025-67507
Filament multi-factor authentication (app) recovery codes can be used multiple times
Medium
CVE-2025-66625
Umbraco Vulnerable to Improper File Access and Credential Exposure in Dictionary Import Functionality
High
CVE-2025-66457
Elysia affected by arbitrary code injection through cookie config
Critical
CVE-2025-66456
Elysia vulnerable to prototype pollution with multiple standalone schema validation
High
CVE-2025-13339
Hippoo Mobile App for WooCommerce <= 1.7.1 - Unauthenticated Arbitrary File Read
Critical
CVE-2025-13613
Elated Membership <= 1.2 - Authentication Bypass via Social Login
Medium
CVE-2025-14313
Advance WP Query Search Filter <= 1.0.10 - Reflected Cross-Site Scripting
Medium
CVE-2025-66135
Imager for Elementor <= 2.0.4 - Missing Authorization
Medium
CVE-2025-67962
Broken Link Checker <= 1.2.6 - Authenticated (Author+) SQL Injection
Medium
CVE-2025-13677
Simple Download Counter <= 2.2.2 - Authenticated (Administrator+) Arbitrary File Read via Path Traversal
High
CVE-2025-14390
Video Merchant <= 5.0.4 - Cross-Site Request Forgery to Arbitrary File Upload
Medium
CVE-2025-14312
Advance WP Query Search Filter <= 1.0.10 - Reflected Cross-Site Scripting
Critical
CVE-2025-67489
@vitejs/plugin-rsc Remote Code Execution through unsafe dynamic imports in RSC server function APIs on development server
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.