EUVD-2026-121638

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the countrows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates an...

CVE-2026-125322

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the countrows tool accepted subqueries against tables other than the table named in the tool call. A caller could use predicates an...

CVE-2026-125321

pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-supplied X-Forwarded-For value as the client addre...

CVE-2026-125320

The pgEdge Postgres MCP Server (versions prior to 1.1.0 ) contains a vulnerability where the HTTP transport fails to validate the Origin header on incoming requests. This flaw allows an attacker to perform a DNS rebinding attack against a user visiting a malicious webpage. If the server is runnin...

CVE-2026-125271

The awslabs aws-api-mcp-server (versions before 1.5.1 ) is vulnerable to a security policy bypass due to incorrect normalization of operation names within the custom security policy enforcement. An actor may execute AWS API operations across services that were configured to be denied or required ...

CVE-2026-125271 AWS API MCP Server Security Policy Bypass via Incorrect Operation Name Normalization

Incorrect normalization of operation names in the custom security policy enforcement in awslabs aws-api-mcp-server before 1.5.1 might allow an actor to execute AWS API operations across AWS services that the operator's security policy was configured to deny or require elicitation for, via calls t...

CVE-2026-112137

A vulnerability has been identified in Mendix Studio Pro 11 All versions = V11.15.0 = V11.12.6 V11.12.7. The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery CSRF. This could allo...

CVE-2026-112136

A vulnerability has been identified in Mendix Studio Pro 11 All versions = V11.15.0 = V11.12.6 V11.12.7. The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with...

CVE-2026-112137

A vulnerability has been identified in Mendix Studio Pro 11 All versions = V11.15.0 = V11.12.6 V11.12.7. The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery CSRF. This could allo...

CVE-2026-112137

A vulnerability exists in Mendix Studio Pro 11 (versions >= V11.15.0 = V11.12.6

EUVD-2026-120891

A vulnerability has been identified in Mendix Studio Pro 11 All versions = V11.15.0 = V11.12.6 V11.12.7. The affected products MCP Server does not properly validate Content-Type and Origin headers on incoming HTTP requests, leaving it vulnerable to Cross-Site Request Forgery CSRF. This could allo...

CVE-2026-112136

A vulnerability has been identified in Mendix Studio Pro 11 All versions = V11.15.0 = V11.12.6 V11.12.7. The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with...

CVE-2026-112136

A vulnerability exists in Mendix Studio Pro 11 versions >= V11.15.0 = V11.12.6

EUVD-2026-120890

A vulnerability has been identified in Mendix Studio Pro 11 All versions = V11.15.0 = V11.12.6 V11.12.7. The affected products MCP Server does not properly restrict its HTTP listener to the loopback interface, leaving it potentially exposed to remote systems. This could allow an attacker with...

Security-Detections-MCP

Security Detections MCP An MCP Model Context Protocol server that lets LLMs query a unified database of Sigma , Splunk ESCU , Elastic , KQL , Sublime Sublime Security and delivr.to, and CrowdStrike CQL security detection rules. New here? Start with theSetup Guide -- covers macOS, Windows WSL &...

firefox-devtools-mcp

Firefox DevTools MCP Model Context Protocol server that lets AI agents use Firefox. It has two main use cases: Agentic browsing : the agent uses the browser for regular tasks, such as reading pages, filling forms and going through multi-step flows on websites. Agent-assisted web development : the...

osint-tools-mcp-server

🔍 OSINT Tools MCP Server A comprehensive MCP server that exposes multiple OSINT tools to AI assistants like Claude. This server allows AI to perform sophisticated reconnaissance and information gathering tasks using industry-standard OSINT tools. 🛠️ Available Tools 🔍 Sherlock - Username Search...

coderunner

CodeRunner: A local sandbox for your AI agents CodeRunner helps you sandbox your AI agents and its actions inside a sandbox. Key use case: Run AI agent code in a sandbox with explicitly chosen host mounts and network access. Isolation reduces risk; it does not prevent all data loss or exfiltratio...

LiteLLM 1.18.10 - Command Injection

LiteLLM 1.18.10 contains a remote code execution caused by lack of validation of arbitrary command and args in MCP server creation, letting attackers execute OS commands remotely, exploit requires crafted JSON configuration. id: CVE-2026-30623 info: name: LiteLLM 1.18.10 - Command Injection autho...

ghidra-mcp

Ghidra MCP Server If you find this useful, please ⭐ star the repo — it helps others discover it! If Ghidra MCP saves you time, consider sponsoring the project. One-time and recurring support both help fund compatibility updates, production hardening, docs, and new tooling. A production-ready Mode...