Medium
CVE-2025-43809
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,647
Medium
CVE-2025-43803
Liferay Contacts Center widget has insecure direct object reference
Medium
CVE-2025-9882
osTicket WP Bridge <= 1.9.2 - Cross-Site Request Forgery to Stored Cross-Site Scripting
Medium
CVE-2025-9887
Custom Login And Signup Widget <= 1.0 - Cross-Site Request Forgery
Medium
CVE-2025-9883
Browser Sniff <= 2.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting
High
CVE-2025-59532
Codex has sandbox bypass due to bug in path configuration logic
Medium
CVE-2025-10002
ClickWhale <= 2.5.0 - Authenticated (Admin+) SQL injection
Medium
CVE-2025-10652
Robcore Netatmo <= 1.7 - Authenticated (Contributor+) SQL Injection via robcore-netatmo Shortcode
High
CVE-2025-9906
Keras is vulnerable to Deserialization of Untrusted Data
High
CVE-2025-9905
The Keras `Model.load_model` method **silently** ignores `safe_mode=True` and allows arbitrary code execution when a `.h5`/`.hdf5` file is loaded.
Medium
CVE-2025-59717
@digitalocean/do-markdownit has Type Confusion vulnerability
Medium
CVE-2025-59713
Snipe-IT allows unsafe deserialization
Medium
CVE-2025-59712
Snipe-IT allows XSS
High
CVE-2025-7665
Miniorange OTP Verification with Firebase 3.1.0 - 3.6.2 - Unauthenticated Privilege Escalation
Medium
CVE-2025-9949
Internal Links Manager <= 3.0.1 - Cross-Site Request Forgery
Medium
CVE-2025-10720
WP Private Content Plus <= 3.6.2 - Unauthenticated Information Exposure
Medium
CVE-2025-10305
Secure Passkeys <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Passkey Exposure and Deletion
Medium
CVE-2025-10124
Booking Manager – Sync WP Booking Calendar – Import Events, Export Bookings to ICS Calendar <= 2.1.14 - Authenticated (Contributor+) Booking Deletion
Medium
CVE-2025-53424
WooCommerce Orders & Customers Exporter <= 5.4 - Missing Authorization
Medium
CVE-2025-53423
Triss <= 2.6 - Reflected Cross-Site Scripting
Medium
CVE-2025-58916
Author: Munzir <= 0.9 - Reflected Cross-Site Scripting
Medium
CVE-2025-10489
SureForms – Drag and Drop Form Builder for WordPress <= 1.12.0 - Missing Authorization to Authenticated (Contributor+) Form Creation
Medium
CVE-2025-10658
SupportCandy – Helpdesk & Customer Support Ticket System <= 3.3.7 - Authentication Bypass to Support Session Takeover
Medium
CVE-2025-10181
Draft List <= 2.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.