CVE-2025-51846High· 7.5▾ MidnightPoC availableCryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. Fixed in 2026.2.2.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.6%
1 GitHub repo (last check)
CryptPad 2025.3.1 allows unbounded WebSocket frame flood. A remote, unauthenticated attacker can significantly degrade or deny service for all users of a CryptPad instance. Fixed in 2026.2.2.
cryptpad >= 2025.3.1, < 2026.2.2Upgrade past the affected range:
cryptpad 2026.2.2Connected by shared product, vendor, weakness, or advisory.
CVE-2025-66473High· 7.5XWiki is an open-source wiki software platform
CVE-2026-0897High· 7.5Allocation of Resources Without Limits or Throttling in the HDF5 weight loading component in Google Keras 3.0.0 through 3.13.0 on all platforms allows a remote attacker to cause a Denial of Service (DoS) through memory exhaustion and a c…
CVE-2025-55748High· 7.5XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it
CVE-2025-55749High· 7.5XWiki is an open-source wiki software platform
CVE-2025-66472Medium· 6.1XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it
CVE-2025-11362High· 7.5Versions of the package pdfmake from 0.3.0-beta.1 and before 0.3.0-beta.17 are vulnerable to Allocation of Resources Without Limits or Throttling via repeatedly redirect URL in file embedding