frida-c2-mcp

FridaC2MCP An MCP server with streamable HTTP transport that runs Frida's dynamic instrumentation entirely on-device — no client-side tooling required. This project runs directly on rooted Android and jailbroken iOS devices , exposing Frida as a set of tools callable over HTTP. Any MCP-compatible...

pentest-mcp

Pentest MCP Pentest MCP is a TypeScript MCP server for authorized security assessments. It gives a human researcher or a tool-using assessment agent one scoped interface for discovery, validation, capture, credential checks, local audit, evidence retrieval, and report preparation. Each active too...

CVE-2026-120234

A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be use...

CVE-2026-120234 ag-ui-protocol ag-ui HTTP Transport e.text resource consumption

A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be use...

CVE-2026-120234

A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be use...

CVE-2026-120234

A vulnerability exists in the ag-ui-protocol ag-ui component (versions up to 0.0.58 ) within the HTTP Transport component. The issue specifically impacts the e.text function, where a manipulation can lead to resource consumption . This attack can be launched remotely , and the exploit is currentl...

EUVD-2026-114860

A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be use...

CVE-2026-120234 ag-ui-protocol ag-ui HTTP Transport e.text resource consumption

A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be use...

CVE-2026-120234: ag-ui-protocol ag-ui: A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58

A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be use...

PT-2026-134913

A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be use...

CVE-2026-62264

The @sylphx/pdf-reader-mcp Model Context Protocol server (versions 2.2.0 through 3.0.1 ) contains a vulnerability where the opt-in HTTP transport (MCP_TRANSPORT=http ) fails to validate the X-API-Key header on incoming requests. Although the server logs that authentication is enabled, it only rea...

CVE-2026-62264 PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when MCPTRANSPORT=http enables the opt-in HTTP server, @sylphx/pdf-reader-mcp reads MCPAPIKEY and logs that X-API-Key authentication is enabled but never validates the X-API-Ke...

CVE-2026-62264 PDF Reader MCP: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when MCPTRANSPORT=http enables the opt-in HTTP server, @sylphx/pdf-reader-mcp reads MCPAPIKEY and logs that X-API-Key authentication is enabled but never validates the X-API-Ke...

CVE-2026-62264

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when "MCPTRANSPORT=http" enables the opt-in HTTP server, "@sylphx/pdf-reader-mcp" reads "MCPAPIKEY" and logs that "X-API-Key" authentication is enabled but never validates the...

@sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

Impact When @sylphx/pdf-reader-mcp is run as an HTTP server MCPTRANSPORT=http, it reads the MCPAPIKEY environment variable and logs API key authentication enabled X-API-Key header at startup, but it never validated the X-API-Key header on incoming requests. The key was read into a variable and...

GHSA-Q344-5V34-GM84 @sylphx/pdf-reader-mcp: HTTP transport accepts unauthenticated requests despite a configured MCP_API_KEY

Impact When @sylphx/pdf-reader-mcp is run as an HTTP server MCPTRANSPORT=http, it reads the MCPAPIKEY environment variable and logs API key authentication enabled X-API-Key header at startup, but it never validated the X-API-Key header on incoming requests. The key was read into a variable and...

Missing Origin Validation

obsidian-tc is vulnerable to missing Origin and DNS-rebinding validation. The vulnerability is due to missing Host, Origin, and DNS-rebinding validation in the Streamable HTTP transport when authentication is disabled, which allows an attacker to exploit a malicious webpage to gain unrestricted...

PT-2026-133248

Impact When @sylphx/pdf-reader-mcp is run as an HTTP server MCP TRANSPORT=http, it reads the MCP API KEY environment variable and logs API key authentication enabled X-API-Key header at startup, but it never validated the X-API-Key header on incoming requests. The key was read into a variable and...

PT-2026-133262

Name of the Vulnerable Software and Affected Versions PDF Reader MCP versions 2.2.0 through 3.0.0 Description When the opt-in HTTP server is enabled via MCP TRANSPORT=http, the server logs that X-API-Key authentication is active after reading the MCP API KEY variable, but it fails to validate the...

Obsidian-tc HTTP Transport Lacks Origin/DNS-rebinding Protection, Enabling Drive-by Vault Access On Loopback

Impact The Streamable HTTP transport was constructed without "enableDnsRebindingProtection"/"allowedHosts"/"allowedOrigins" and performed no "Origin"-header validation. With the documented "auth.mode: "none"" loopback default, a drive-by web page could "POST http://127.0.0.1/mcp" and receive call...