CVE-2026-81100 Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

CVE-2026-81099

Timescale's tiger-slack failed to enable the DNS-rebinding-protection option when starting its MCP HTTP transport in mcp/src/httpServer.ts, leaving the host allow-list disabled. This allowed a malicious web page to use DNS rebinding to steer requests to the locally bound Slack MCP server through ...

CVE-2026-81099 Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

EUVD-2026-67023

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...

EUVD-2026-67147

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

httrack v3.49.24

HTTrack Website Copier - Development Repository About Copy websites to your computer Offline browser HTTrack is an offline browser utility, allowing you to download a World Wide website from the Internet to a local directory, building recursively all directories, getting html, images, and other...

Hx0-HawkEye v1.0.6

🦅 Hx0 HawkEye: Full-stack lightweight capture & AI security auditing extension 【中文 / English】 1. What it is Skip the proxy hassle—truly ready out of the box. Hx0 HawkEye is a native browser extension Chrome / Firefox and mainstream Chromium that gives you a full capture, intercept HTTP + WebSocke...

PT-2026-82572

tiger-slack started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, and a page i...

PT-2026-82842

A stored cross-site scripting XSS vulnerability in WatchGuard Dimension's task scheduling feature allows a low-privileged authenticated administrator to inject arbitrary HTML/JavaScript into these fields, which then executes in the browser session of any other user...

PT-2026-82575

Name of the Vulnerable Software and Affected Versions Dash MCP server affected versions not specified Description In network mode, the server binds its listener to the loopback address but fails to verify the host name of incoming requests. Within src/mcp server dash.py, the server is configured...

Chromium, Google Chrome, Microsoft Edge. Opera: Multiple Vulnerabilities

Background Chromium is an open-source browser project that aims to build a safer, faster, and more stable way for all users to experience the web. Google Chrome is one fast, simple, and secure browser for all your devices. Microsoft Edge is a browser that combines a minimal design with...

GLSA-202608-31 : Chromium, Google Chrome, Microsoft Edge, Opera, Vivaldi: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202608-31 Chromium, Google Chrome, Microsoft Edge, Opera, Vivaldi: Multiple Vulnerabilities Multiple vulnerabilities have been discovered in Chromium, Google Chrome, Microsoft Edge, Opera, and Vivaldi. Please review the CVE...

CVE-2026-59288: Exposure of Sensitive Information to an Unauthorized Actor

The GraphiQL page bundled with Spring for GraphQL sends requests to the GraphQL endpoints of the application. An attacker can share a malicious URL so that the victim's browser might leak confidential information to the attacker's website. Spring for GraphQL 2.0.0 - 2.0.4 Spring for GraphQL 1.4.0...

DRUPAL-CONTRIB-2026-116

This module enables you to create one or more multisites with highly granular page permissions. The module doesn't sufficiently sanitize HTML code contained in the page name when displayed in the built-in tree browser. This results in a cross-site scripting vulnerability that may allow attackers ...

CVE-2026-79284

A flaw was found in chromium-browser. A remote attacker, after compromising the renderer process, could exploit this vulnerability by crafting a malicious HTML page. This would allow the attacker to spoof user interface UI elements, potentially deceiving users...

CVE-2026-79040

An uninitialized resource flaw was found in the GPU component of the Chromium browser. Upstream bugs: https://code.google.com/p/chromium/issues/detail?id=516950646...

CVE-2026-79225

A flaw was found in chromium-browser. This incorrect authorization vulnerability allows a remote attacker to bypass system access restrictions. The attacker can achieve this by leveraging social engineering techniques through user interface UI interaction...

CVE-2026-79021

A flaw was found in chromium-browser. This vulnerability, related to missing authorization in the InterestGroups component, allows a remote attacker to bypass system access restrictions. The attacker must first compromise the browser's rendering engine and then use a specially crafted PDF file to...

CVE-2026-79287

A flaw was found in chromium-browser. A remote attacker could exploit an observable discrepancy in Forms by crafting a malicious HTML page. This could allow the attacker to obtain sensitive information from the user...

CVE-2026-79293

A flaw was found in chromium-browser. A remote attacker could exploit an information leak in the Animation component by crafting a malicious HTML page. This could allow the attacker to obtain sensitive information from the user's browser...