Medium
CVE-2025-64746
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
High
CVE-2025-71328
Flowise does not Prevent Bypass of Password Confirmation - Unverified Password Change
High
CVE-2025-71337
Flowise doesn't Prevent Bypass of Password Confirmation through Unverified Email Change (credentials)
High
CVE-2025-71335
Flowise Fails to Invalidate Existing Sessions After Password Changes
Medium
ghsa-2w46-vq8h-98vh
Shopware 6's password recovery link does not expire after email change
Low
CVE-2025-64711
PrivateBin vulnerable to malicious filename use for self-XSS / HTML injection locally for users
Medium
CVE-2025-64714
PrivateBin's template-switching feature allows arbitrary local file inclusion through path traversal
High
CVE-2025-13204
expr-eval vulnerable to Prototype Pollution
Medium
CVE-2025-12849
Contest Gallery <= 28.0.2 - Missing Authorization
High
CVE-2025-64530
@apollo/composition has Improper Enforcement of Access Control on Interface Types and Fields
Medium
CVE-2025-12847
All in One SEO – Powerful SEO Plugin to Boost SEO Rankings & Increase Traffic <= 4.8.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Deletion
Medium
CVE-2025-12494
Image Gallery – Photo Grid & Video Gallery <= 2.12.28 - Improper Authorization to Authenticated (Author+) Arbitrary Image File Move
Medium
CVE-2025-12182
Qi Blocks <= 1.4.3 - Missing Authorization to Arbitrary Attachment Resize
Medium
CVE-2025-64718
js-yaml has prototype pollution in merge (<<)
Medium
CVE-2025-67539
Select Core < 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-66062
YouTube Lyte <= 1.7.28 - Open Redirect
Medium
CVE-2025-66091
Stylish Cost Calculator <= 8.1.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-64269
WooCommerce PDF Invoice Builder <= 1.2.150 - Missing Authorization
Medium
CVE-2025-66063
Google Review Slider <= 17.4 - Missing Authorization
Medium
CVE-2025-8994
WP Project Manager <= 2.6.26 - Authenticated (Subscriber+) SQL Injection via 'completed_at_operator'
High
CVE-2025-67521
Select Core < 2.6 - Authenticated (Contributor+) Local File Inclusion
Medium
CVE-2025-66090
SKT Skill Bar <= 2.5 - Authenticated (Contributor+) Stored Cross-Site Scripting
Medium
CVE-2025-64276
Survey Maker <= 5.1.9.4 - Missing Authorization
Medium
CVE-2025-64375
Social Ninja <= 3.20.1 - Missing Authorization
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.