CVE-2026-81100

tiger-gh-mcp-server (by Timescale) started its MCP HTTP transport without enabling the DNS-rebinding-protection option provided by the underlying SDK. The file src/httpServer.ts called the shared httpServerFactory helper but never set the host allow-list, so the transport accepted requests regard...

GO-2026-4569 vulnerabilities

Vulnerabilities for packages: ferretdb, datadog-agent, gptscript, github-mcp-server, jaeger, osv-scanner, opencost...

GO-2026-5779 GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server

GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server...

CVE-2026-48529

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...

CVE-2026-48529 GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: local-path-provisioner, smarter-device-manager, volume-modifier-for-k8s, flux, secrets-store-csi-driver-provider-aws, hubble, supercronic, victoriametrics-cluster, clickhouse-operator, dbmate, nova, dataplaneapi, sftpgo-plugin-eventsearch, actions-runner-controller,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: nemo, spire-server, grafana-operator-fips, ingress-nginx-controller, rabbitmq-messaging-topology-operator, commercial-expanso-edge, victorialogs-fips, karpenter-fips, mariadb-operator-fips, oras, eks-node-monitoring-agent, local-path-provisioner, localstack,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: nemo, spire-server, grafana-operator-fips, ingress-nginx-controller, rabbitmq-messaging-topology-operator, commercial-expanso-edge, victorialogs-fips, karpenter-fips, mariadb-operator-fips, oras, eks-node-monitoring-agent, local-path-provisioner, localstack,...