CVE•Published 2025-07-09•1 article on news•7 live references•NVD data
CVE-2025-6514
Vulnerability data via CVEDB (Shodan)
CVSS v3.1
9.6
CRITICAL
EPSS percentile
100
Exploit Prediction Scoring System · top 0% of all CVEs
Description
mcp-remote is exposed to OS command injection when connecting to untrusted MCP servers due to crafted input from the authorization_endpoint response URL
Timeline
Published 2025-07-09
External references
Search for exposed instances
Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).
More intel sources (5)
Shodan report
vuln:CVE-2025-6514Country / ASN / product breakdown for the vuln query.
Censys
vulnerabilities.cve_id: CVE-2025-6514Censys host search filtered to this CVE id.
grep.app
CVE-2025-6514Public source-code mentions — fast PoC discovery.
GitHub code
CVE-2025-6514GitHub code search for direct mentions.
Google dork
"CVE-2025-6514" exploit -site:nvd.nist.govWrite-ups and news, NVD excluded.
Known PoCs on GitHub (8)
CVE-2025-65148 repos
Pantheon-Security/medusaPython
AI-first security scanner. NEW in v2026.7: Claude Code compromise detection — vet .claude/ hooks, permissions & skills before you clone — plus an always-on AI attack-signature scan…
anmolksachan/AI-ML-Free-Resources-for-Security-and-Prompt-Injectionunknown
AI/ML Pentesting Roadmap for Beginners
LLMSecurity/awesome-agent-skills-securityunknown
🛡️ A curated list of resources on agent skills security: attacks, defenses, frameworks, and benchmarks for securing AI agent tool use and skill ecosystems
7WaySecurity/ai_osintunknown
🤖 Curated AI OSINT resources — Google dorks, Shodan queries, GitHub dorks, and techniques to discover exposed LLM endpoints, leaked AI API keys, misconfigured vector databases, an…
atlas-bear/osint-ai-guidePython
Comprehensive guide to AI applications in OSINT workflows and intelligence analysis
CircleCI-Public/mcp-server-circleciTypeScript
[DEPRECATED] This package is no longer maintained. Migrate to CircleCI's hosted MCP server or the CircleCI CLI MCP. See https://circleci.com/docs/guides/toolkit/circleci-mcp-overvi…
jassics/awesome-genai-securityunknown
Curated list of links, references, books videos, tutorials (Free or Paid), Exploit, CTFs, Hacking Practices etc. which are related to GenAI and LLM Security
h5i-dev/awesome-ai-agent-incidentsunknown
A curated corpus of incidents, attack vectors, failure modes, and defensive tools for autonomous AI agents.