CVE-2026-81100

tiger-gh-mcp-server (by Timescale) started its MCP HTTP transport without enabling the DNS-rebinding-protection option provided by the underlying SDK. The file src/httpServer.ts called the shared httpServerFactory helper but never set the host allow-list, so the transport accepted requests regard...

CVE-2026-81100 Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making t...

GO-2026-4569 vulnerabilities

Vulnerabilities for packages: datadog-agent, opencost, ferretdb, github-mcp-server, jaeger, gptscript, osv-scanner...

GO-2026-5779 GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server

GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion in github.com/github/github-mcp-server...

CVE-2026-48529

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...

CVE-2026-48529 GitHub MCP Server: Lockdown mode singleton in HTTP server causes cross-user GraphQL client confusion

GitHub MCP Server is GitHub's official MCP Server. From 0.22.0 until 1.1.2, when running in HTTP mode with --lockdown-mode enabled, the RepoAccessCache is implemented as a process-global singleton initialized with the first authenticated user's GraphQL client. All subsequent requests from differe...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: stakater-reloader, smokescreen, polaris, grafana-rollout-operator, flux-notification-controller, goreleaser, victoriametrics-cluster, dataplaneapi, supercronic, dgraph, flux-image-reflector-controller, external-secrets-operator, envoy-ratelimit, osv-scanner, go,...

CVE-2026-33810 vulnerabilities

Vulnerabilities for packages: flux-source-controller, victoriametrics-fips, dkron, eks-node-monitoring-agent, malcontent, newrelic-k8s-metadata-injection-fips, flux-image-reflector-controller, pgwatch, actions-runner-controller, omnibump, aws-privateca-issuer-fips, grafana-operator,...

GHSA-FV83-X2XW-2J55 vulnerabilities

Vulnerabilities for packages: flux-source-controller, victoriametrics-fips, dkron, eks-node-monitoring-agent, malcontent, newrelic-k8s-metadata-injection-fips, flux-image-reflector-controller, pgwatch, actions-runner-controller, omnibump, aws-privateca-issuer-fips, grafana-operator,...