Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 7,501
Reset filtersn8n has Public API Variables IDOR that Allows Cross-Project Secret Disclosure
n8n Vulnerable to Unauthenticated Denial of Service via MCP Client Registration
n8n Vulnerable to Hijacking of Unauthenticated Chat Execution
n8n has SQL Injection in SeaTable Node
n8n has Open Redirect in MCP OAuth Consent Flow
n8n has SQL Injection in Oracle Database Node via Limit Field
n8n has SQL Injection in Snowflake and MySQL Nodes
CyberChef has a Cross-site Scripting issue
Apache Thrift Node.js bindings vulnerable to Uncontrolled Recursion
BigSweetPotatoStudio HyperChat has a Server-Side Request Forgery issue
OpenClaw: Agent gateway config mutations could change protected operator settings
OpenClaw: Bundled MCP/LSP tools could bypass configured tool policy
OpenClaw: Workspace dotenv MiniMax host override could redirect credentialed requests
OpenClaw: Browser CDP profile creation skipped strict-mode SSRF checks
OpenClaw: Paired-device pairing actions were not limited to the caller device
OpenClaw: QQBot direct media upload skipped URL SSRF validation
OpenClaw: MCP stdio server env could load dangerous startup variables from workspace config
OpenClaw: Isolated cron awareness events were recorded as trusted system events
OpenClaw: Workspace dotenv could override runtime-control environment variables
OpenClaw: Feishu card actions could misclassify DMs and skip dmPolicy
OpenClaw: Assistant media route missed scope enforcement for trusted-proxy authorization
OpenClaw: Hook mapping templates could bypass hook session-key opt-in
n8n-MCP: Sensitive MCP tool-call arguments logged on authenticated requests in HTTP mode
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.