CVE-2026-104120 modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetchurl of the file mcpserverfetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side request...

EUVD-2026-91161

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetchurl of the file mcpserverfetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side request...

PT-2026-104071

A security vulnerability has been detected in modelcontextprotocol mcp-server-fetch and mcp-server-everything up to 2026.6.4. Affected is the function fetch url of the file mcp server fetch/server.py of the component Fetch Tool. The manipulation of the argument url/path leads to server-side reque...

Pentest-Everything

⚔️ Pentest Everything Importante Marca esta página como favorita, ya que es probable que los otros enlaces de páginas cambien o se muevan con el tiempo. Esta página siempre permanecerá igual. Acerca de este libro Este libro es mi colección de notas y write-ups sobre diversos temas y plataformas de...

CVE-2026-79403

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...

CVE-2026-79403

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...

CVE-2026-79403

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...

EUVD-2026-89423

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...

CVE-2026-79403

Versions of Kilo Code prior to v7.4.1 are vulnerable to an issue that allows a local attacker to achieve arbitrary code execution . The vulnerability is accessible via the permission/allow-everything endpoint. While the technical root cause is not explicitly detailed in the provided documents, th...

CVE-2026-79403

An issue in Kilo Code before v7.4.1 allows a local attacker to execute arbitrary code via the permission/allow-everything endpoint...

CVE-2023-27704

CVE-2023-27704 CVE-2023-27704 Se descubrió que Void Tools Everything anterior a v1.4.1.1022 contiene una Denegación de Servicio por Expresión Regular ReDoS corregido en Everything 1.5 alpha Descripción sugerida Se descubrió que Void Tools Everything anterior a v1.4.1.1022 contiene una Denegación ...

WordPress BA Book Everything plugin <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Adrien Brunner in WordPress Plugin BA Book Everything versions = 1.8.27...

CVE-2026-96039

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via firstname Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-96039

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.8.27 . The root cause is insufficient input sanitization and output escaping of the first_name parameter. This allows unauthenticated attackers to inject arbitrary ...

EUVD-2026-86546

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via firstname Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-96039 BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via firstname Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-96039 BA Book Everything <= 1.8.27 - Unauthenticated Stored Cross-Site Scripting via first_name Parameter

The BA Book Everything plugin for WordPress is vulnerable to Stored Cross-Site Scripting via firstname Parameter in all versions up to, and including, 1.8.27 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web...

CVE-2026-41714 In Spring AMQP the RabbitConnectionFactoryBean.setUri("amqps://...") bypasses secure SSL setup, uses TrustEverythingTrustManager

Applications that configure their broker connection via RabbitConnectionFactoryBean.setUri"amqps://..." without also calling setUseSSLtrue get TLS encryption with no certificate validation and no hostname verification. Affected versions: Spring AMQP 4.0.0 through 4.0.3; 3.2.0 through 3.2.10; 3.1....

Malicious code in kyxserver-everything (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7be104f8e720927f9b7ea1bb3d036db80ffa6b65c8b7f0a6c8af29d1d4631f43 The package kyxserver-everything was found to contain malicious code. Source: ghsa-malware...

MAL-2026-1955 Malicious code in kyxserver-everything (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7be104f8e720927f9b7ea1bb3d036db80ffa6b65c8b7f0a6c8af29d1d4631f43 The package kyxserver-everything was found to contain malicious code. Source: ghsa-malware...