High severity
ssrfcheck: SSRF Bypass Caused by Failure to Classify Reserved IP Address Space as Invalid
ssrfcheck · npm
CVE-2025-8267 · GHSA-p4hc-9pjh-55c8
Research / Coordinated disclosure
CVEs & security advisories.
Vulnerabilities I have received public credit for disclosing, across developer tooling, JavaScript packages, runtimes, and MCP servers. Each record links to the original advisory and its remediation details.
- Active advisories
- 41
- Critical severity
- 7
- Withdrawn records
- 2
GitHub snapshot: Oct 19, 2026. The 43 records below include 2 withdrawn entries, which are excluded from active and critical counts. Advisory records are not necessarily distinct vulnerabilities; credits may be shared with other researchers.
Disclosure archive
Showing 43 of 43 records
Moderate severity
willitmerge has a Command Injection vulnerability
willitmerge · npm
CVE-2025-66219 · GHSA-j9wj-m24m-7jj6
Moderate severity
Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode
doris-mcp-server · pip
CVE-2025-58337 · GHSA-m35w-xx8c-6xc7
Critical severity
check-branches is vulnerable to command Injection
check-branches · npm
CVE-2025-11148 · GHSA-9c4g-fp4r-prrv
High severity
@nubosoftware/node-static failure to catch exception can result in server crash
@nubosoftware/node-static · npm
CVE-2025-11149 · GHSA-27w5-gj5q-82fv
Moderate severity
Mastra Docs MCP Server @mastra/mcp-docs-server Leads to Information Exposure
@mastra/mcp-docs-server · npm
CVE-2025-61685 · GHSA-xh92-rqrq-227v
Critical severity
High severity
git-comiters Command Injection vulnerability
git-commiters · npm
CVE-2025-59831 · GHSA-g38c-wxjf-xrh6
Moderate severity
@conventional-changelog/git-client has Argument Injection vulnerability
@conventional-changelog/git-client · npm
CVE-2025-59433 · GHSA-vh25-5764-9wcr
High severity
@executeautomation/database-server does not properly restrict access, bypassing a "read-only" mode
@executeautomation/database-server · npm
CVE-2025-59333 · GHSA-65hm-pwj5-73pw
Critical severity
interactive-git-checkout has a Command Injection vulnerability
interactive-git-checkout · npm
CVE-2025-59046 · GHSA-4wcm-7hjf-6xw5
Critical severity
@akoskm/create-mcp-server-stdio is vulnerable to MCP Server Command Injection through exec API
@akoskm/create-mcp-server-stdio · npm
CVE-2025-54994 · GHSA-3ch2-jxxc-v4xf
High severity
Withdrawn
Duplicate Advisory: ssrfcheck has Incomplete IP Address Deny List that leads to Server-Side Request Forgery Vulnerability
ssrfcheck · npm
GHSA-c2fv-2fmj-9xrx
High severity
Withdrawn
Withdrawn Advisory: bun vulnerable to OS Command Injection
bun · npm
CVE-2025-8022 · GHSA-4j66-8f4r-3pjx
High severity
files-bucket-server vulnerable to Directory Traversal
files-bucket-server · npm
CVE-2025-8021 · GHSA-3r3j-4vrw-884j
High severity
private-ip vulnerable to Server-Side Request Forgery
private-ip · npm
CVE-2025-8020 · GHSA-9h3q-32c7-r533
High severity
GitHub Kanban MCP Server vulnerable to Command Injection
@sunwood-ai-labs/github-kanban-mcp-server · npm
CVE-2025-53818 · GHSA-6jx8-rcjx-vmwf
Moderate severity
iOS Simulator MCP Command Injection allowed via exec API
ios-simulator-mcp · npm
CVE-2025-52573 · GHSA-6f6r-m9pv-67jw
High severity
High severity
parse-duration has a Regex Denial of Service that results in event loop delay and out of memory
parse-duration · npm
CVE-2025-25283 · GHSA-hcrg-fc28-fcg5
Critical severity
Parsed HTML anchor links in Markdown provided to parseMarkdown can result in XSS in @nuxtjs/mdc
@nuxtjs/mdc · npm
CVE-2025-24981 · GHSA-j82m-pc2v-2484
Moderate severity
Bun has an Application-level Prototype Pollution vulnerability in the runtime native API for Glo
bun · npm
CVE-2024-21548 · GHSA-v9mx-4pqq-h232
Moderate severity
ggit is vulnerable to Arbitrary Argument Injection via the clone() API
ggit · npm
CVE-2024-21533 · GHSA-pr45-cg4x-ff4m
High severity
High severity
Moderate severity
blamer vulnerable to Arbitrary Argument Injection via the blameByFile() API
blamer · npm
CVE-2023-26143 · GHSA-6f9p-g466-f8v8
High severity
High severity
node-static and @nubosoftware/node-static vulnerable to Directory Traversal
@nubosoftware/node-static · npm
CVE-2023-26111 · GHSA-5g97-whc9-8g7j
High severity
Denial of Service vulnerability in lite-web-server
lite-web-server · npm
CVE-2023-26104 · GHSA-8237-3q5g-99fv
Moderate severity
High severity
High severity
Directory Traversal vulnerability in serve-lite
serve-lite · npm
CVE-2022-21192 · GHSA-5qq4-m6c3-xxmf
Moderate severity
High severity
lite-dev-server vulnerable to Directory Traversal
lite-dev-server · npm
CVE-2022-25895 · GHSA-pppv-ch8p-rp2w
High severity
easy-static-server vulnerable to Directory Traversal
easy-static-server · npm
CVE-2022-25931 · GHSA-wcwm-c3mr-pxcr
High severity
lite-server vulnerable to Denial of Service
lite-server · Maven
CVE-2022-25940 · GHSA-89w7-5q45-r53w
High severity
static-dev-server vulnerable to path traversal
static-dev-server · npm
CVE-2022-25848 · GHSA-7fxm-c848-89q8
High severity
High severity
Critical severity
OS Command Injection in git-pull-or-clone
git-pull-or-clone · npm
CVE-2022-24437 · GHSA-3x62-x456-q2vm
Critical severity
High severity
High severity
No disclosures match these filters. Try another package or CVE, or reset the filters.