mcpsnoop v0.14.0

Wireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal. The problem The official MCP Inspector connects as its own client, so it never sees what your client Cursor, Claude Code, Codex actually sends your server. An...

@anephenix/hub: Unauthenticated WebSocket RPC Waiter Resource Exhaustion

Summary @anephenix/hub starts a setInterval polling loop for every incoming WebSocket connection to request a client ID via RPC. If the remote client never replies — which requires no authentication or special configuration — the interval and the pending request object are never cleaned up, even...

CVE-2026-65709

CVE-2026-65709 concerns sysPass up to version 3.2.11, with a missing object-level authorization vulnerability in the JSON-RPC API. The issue allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access checks. ...

CVE-2026-65709 sysPass 3.2.11 Missing Object-Level Authorization via JSON-RPC API

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke...

CVE-2026-65709

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke...

CVE-2026-65709: Authorization Bypass Through User-Controlled Key

sysPass through version 3.2.11 contains a missing object-level authorization vulnerability in the JSON-RPC API that allows API token holders to enumerate account metadata, overwrite passwords, and delete accounts across the entire vault without per-account access control. Attackers can invoke...

PT-2026-71709

Name of the Vulnerable Software and Affected Versions Hub versions prior to 0.2.16 Description Unauthenticated WebSocket connections trigger the loadDefaultConnectionEventListeners function to call requestClientId, which subsequently executes rpc.send for the get-client-id action and adds a reque...

CVE-2026-47391 PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution

PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculateexpression tool implemented with Python eval. The example also binds to 0.0.0.0. A remote unauthenticated attacker...

Malicious Package

Overview wallet-rpc is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

SUSE CVE-2026-64101

In the Linux kernel, the following vulnerability has been resolved: fwctl: pds: Validate RPC input size before parsing The fwctl core allocates the device-specific RPC input buffer with fwctlrpc.inlen and passes that buffer to the driver callback. pdsfcfwrpc casts the buffer to struct fwctlrpcpds...

mcpsnoop v0.13.0

Wireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal. The problem The official MCP Inspector connects as its own client, so it never sees what your client Cursor, Claude Code, Codex actually sends your server. An...

mcpsnoop v0.12.0

Wireshark for MCP. A transparent proxy that shows every real tool call between your AI client and your MCP servers, live in your terminal. The problem The official MCP Inspector connects as its own client, so it never sees what your client Cursor, Claude Code, Codex actually sends your server. An...

Malicious Package

Overview DiscordRpc.Net is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious Package

Overview Stl.Rpc.Server.Core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

GHSA-M464-HJ36-96VX Duplicate Advisory: SurrealDB has Denial of Service in JSON parser due to nested objects

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-q729-696q-g9pq. This link is maintained to preserve external references. Original Description SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when...

CVE-2026-63757

SurrealDB versions before 3.1.0 contain a session hijacking vulnerability where the HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification. Unauthenticated attackers can enumerate session UUIDs and...

CVE-2026-63756

SurrealDB versions before 3.1.0 contain a time-of-check/time-of-use race condition in the HTTP /rpc endpoint that allows unauthenticated requests to inherit authenticated session state. Unauthenticated attackers can send concurrent requests to the /rpc endpoint while legitimate authenticated...

CVE-2026-63760 SurrealDB before 3.1.0 Denial of Service via JSON Parser

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the...

CVE-2026-63760

SurrealDB before 3.1.0 fails to enforce the configured recursion depth limit in the value and JSON parser when processing nested braces, brackets, or parentheses. Unauthenticated attackers can send deeply nested JSON payloads to the WebSocket /rpc endpoint to exhaust server memory and crash the...

CVE-2026-63757

CVE-2026-63757 affects SurrealDB versions before 3.1.0. The HTTP /rpc sessions method returns attached session UUIDs without authentication and accepts arbitrary session fields with no ownership verification, enabling unauthenticated attackers to enumerate session UUIDs and impersonate authentica...