CVE-2026-123812

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the createdynatracenotebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write tools use that gate to obtain operator...

CVE-2026-123810

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.1.1, several read capabilities interpolate caller-controlled values into DQL without sufficient validation or escaping. The src/capabilities/find-monitored-entity-by-name.ts capability embeds entityNames in string...

EUVD-2026-120447

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the createdynatracenotebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write tools use that gate to obtain operator...

CVE-2026-123812

The Dynatrace MCP Server (an MCP server for Dynatrace Observability) is vulnerable in versions prior to 1.8.7 . The root cause is that the create_dynatrace_notebook registration in src/index.ts performs a persistent document-write action without invoking the requestHumanApproval gate used by othe...

CVE-2026-123812 Dynatrace MCP Server: create_dynatrace_notebook missing the human-approval gate

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the createdynatracenotebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write tools use that gate to obtain operator...

CVE-2026-123810

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.1.1, several read capabilities interpolate caller-controlled values into DQL without sufficient validation or escaping. The src/capabilities/find-monitored-entity-by-name.ts capability embeds entityNames in string...

CVE-2026-123810 Dynatrace MCP Server: DQL injection via parameters not documented as DQL

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.1.1, several read capabilities interpolate caller-controlled values into DQL without sufficient validation or escaping. The src/capabilities/find-monitored-entity-by-name.ts capability embeds entityNames in string...

EUVD-2026-120444

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.1.1, several read capabilities interpolate caller-controlled values into DQL without sufficient validation or escaping. The src/capabilities/find-monitored-entity-by-name.ts capability embeds entityNames in string...

CVE-2026-123810

The Dynatrace MCP Server (prior to version 2.1.1 ) is vulnerable to DQL injection because several read capabilities interpolate caller-controlled values into Dynatrace Query Language (DQL) strings without sufficient validation or escaping. Specifically, the entityNames parameter in find-monitored...

CVE-2026-123810: dynatrace-oss dynatrace-mcp: Dynatrace MCP Server is an MCP server for Dynatrace Observability

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 2.1.1, several read capabilities interpolate caller-controlled values into DQL without sufficient validation or escaping. The src/capabilities/find-monitored-entity-by-name.ts capability embeds entityNames in string...

CVE-2026-123812: dynatrace-oss dynatrace-mcp: Dynatrace MCP Server is an MCP server for Dynatrace Observability

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the createdynatracenotebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write tools use that gate to obtain operator...

PT-2026-141131

Dynatrace MCP Server is an MCP server for Dynatrace Observability. Prior to 1.8.7, the create dynatrace notebook registration in src/index.ts performs a persistent document-write action without calling requestHumanApproval, although the project's other write tools use that gate to obtain operator...

CVE-2026-44840-poc

CVE-2026-44840 — PoC: Dgraph DQL Injection via checkUserPassword GraphQL Docker lab that reproduces a real injection in Dgraph: Vulnerable : dgraph/dgraph:v25.3.3 Patched : dgraph/dgraph:v25.3.4 Real CVE from 2026 · CVSS 3.1 7.5 High · CWE-943 Improper Neutralization in Data Query Logic ·...

CVE-2026-63008

Summary The "SearchHelper" class in Kimai interpolates user-controlled meta-field names from search terms directly into DQL Doctrine Query Language queries without sanitization. When a search term is formatted as "FIELDNAME:VALUE", the "FIELDNAME" portion is parsed by "SearchTermPart" and used...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection via the sortOrder parameter in the AbstractSearchableListAction.php process. An attacker can access sensitive database information, including user credentials and station settings, by injecting arbitrary DQL expressions...

CVE-2026-100847

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settin...

CVE-2026-100847 AzuraCast before 0.23.8 DQL Injection via sortOrder

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settin...

EUVD-2026-87841

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settin...

CVE-2026-100847 AzuraCast before 0.23.8 DQL Injection via sortOrder

AzuraCast before 0.23.8 contains a DQL injection vulnerability in the sortOrder API parameter of AbstractSearchableListAction.php. Attackers can inject arbitrary DQL expressions through the sortOrder parameter to extract sensitive database information including user credentials and station settin...

CVE-2026-100847

AzuraCast versions prior to 0.23.8 are vulnerable to a DQL injection flaw within the sortOrder API parameter of the AbstractSearchableListAction.php file. Attackers can exploit this by injecting arbitrary DQL expressions to extract sensitive database information , including user credentials and s...