Low
CVE-2025-8129
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 2,493
Reset filters
Medium
CVE-2025-54590
webfinger.js Blind SSRF Vulnerability
High
CVE-2025-8021
files-bucket-server vulnerable to Directory Traversal
High
CVE-2025-8020
private-ip vulnerable to Server-Side Request Forgery
Medium
CVE-2025-54139
HAX CMS application pages vulnerable to clickjacking
High
CVE-2025-54134
HAX CMS NodeJS Application Has Improper Error Handling That Leads to Denial of Service
Critical
CVE-2025-7783
form-data uses unsafe random function in form-data for choosing boundary
High
CVE-2025-53832
@translated/lara-mcp vulnerable to command injection in import_tmx tool
Medium
CVE-2025-54066
DiracX-Web is vulnerable to attack through an Open Redirect on its login page
High
CVE-2025-53818
GitHub Kanban MCP Server vulnerable to Command Injection
Medium
CVE-2025-53887
Directus' exact version number is exposed by the OpenAPI Spec
Medium
ghsa-hq75-xg7r-rx6c
Better Call routing bug can lead to Cache Deception
Medium
CVE-2025-53364
Parse Server exposes the data schema via GraphQL API
Critical
CVE-2025-53620
Qwik's unhandled exception vulnerabilty can cause server crashes from malicious requests
Critical
CVE-2025-6514
mcp-remote exposed to OS command injection via untrusted MCP server connections
High
CVE-2025-53355
MCP Server Kubernetes vulnerable to command injection in several tools
Medium
CVE-2025-59427
Cloudflare Vite plugin exposes secrets over the built-in dev server
High
CVE-2025-53372
Node.js Sandbox MCP Server vulnerability can lead to Sandbox Escape via Command Injection
High
CVE-2025-49826
Next.JS vulnerability can lead to DoS via cache poisoning
Low
CVE-2025-49005
Next.js has a Cache poisoning vulnerability due to omission of the Vary header
High
CVE-2025-53110
@modelcontextprotocol/server-filesystem vulnerability allows for path validation bypass via colliding path prefix
High
CVE-2025-53109
@modelcontextprotocol/server-filesystem allows for path validation bypass via prefix matching and symlink handling
High
CVE-2025-53107
@cyanheads/git-mcp-server vulnerable to command injection in several tools
Medium
CVE-2025-52573
iOS Simulator MCP Command Injection allowed via exec API
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.