BIT-CONSUL-2026-14869 terraform-mcp-server vulnerable to server side request forgery leading to token exposure

The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled...

USN-8628-1: libgit2 vulnerabilities

It was discovered that libgit2 incorrectly handled the Git Smart Protocol. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. CVE-2016-10128 It was discovered that libgit2...

USN-8628-1 libgit2 vulnerabilities

It was discovered that libgit2 incorrectly handled the Git Smart Protocol. A remote attacker could possibly use this issue to cause a denial of service or execute arbitrary code. This issue only affected Ubuntu 14.04 LTS and Ubuntu 16.04 LTS. CVE-2016-10128 It was discovered that libgit2...

CVE-2026-18536

A flaw was found in Data-Entropy. This component reads remote entropy randomness sources over unencrypted HTTP. An on-path attacker, such as one on an open Wi-Fi network or a compromised internet service provider ISP, can intercept and alter the responses from these sources. This allows the...

CVE-2026-65655

When OAuth authentication is enabled and browser-facing TLS terminates at a reverse proxy that forwards the callback to Temporal UI Server over HTTP, affected versions derive authentication-cookie Secure attributes from the proxy-to-server connection. Temporal UI Server can therefore issue...

chisel v1.12.0-rc3

Chisel Chisel is a fast TCP/UDP tunnel, transported over HTTP, secured via SSH. Single executable including both client and server. Written in Go golang. Chisel is mainly useful for passing through firewalls, though it can also be used to provide a secure endpoint into your network. Table of...

Security Bulletin:Axios Prototype Pollution: Intercept JSON Responses or Hijack HTTP Transport

Summary Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.1 and 0.31.1, when Object.prototype has been polluted by any co-dependency with keys that axios reads without a hasOwnProperty guard, an attacker can a silently intercept and modify every JSON response before...

CVE-2026-68578

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via t...

CVE-2026-68578

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via t...

PT-2026-67331

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via t...

CVE-2026-68578: Missing Authentication for Critical Function

ArcadeDB versions before 26.7.3 fail to bind the authenticated principal in the MCP HTTP transport, causing all engine permission checks to silently pass as no-ops. Non-root MCP-allowed users can perform arbitrary database writes, DDL, schema mutations, and execute arbitrary JavaScript code via t...

CVE-2026-18536 Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP

Data::Entropy versions before 0.010 for Perl read remote entropy sources over plain HTTP. The Data::Entropy::RawSource::RandomOrg and Data::Entropy::RawSource::RandomnumbersInfo remote sources are accessed over plain HTTP. The Data::Entropy::RawSource::RandomOrg integrity check trivially matches...

PT-2026-75995

Summary @dynatrace-oss/dynatrace-mcp-server v1.8.5 exposes an HTTP transport mode --http flag that performs no authentication, session validation, or origin/host verification before dispatching MCP tool calls. Any network-reachable attacker can send a raw JSON-RPC tools/call request without an...

MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

Summary An unauthenticated remote attacker can force any MCP Ruby SDK server using MCP::Server::Transports::StreamableHTTPTransport to allocate gigabytes of memory by sending a single oversized JSON-RPC POST. The transport reads the entire HTTP body into a Ruby String and parses it with...

EUVD-2026-50498

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood...

GHSA-52JP-GJ8W-J6XH MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

Summary In its default configuration, MCP::Server::Transports::StreamableHTTPTransport never expires sessions. Every successful initialize request stores a new ServerSession and a session record under a fresh UUID, and the only path that removes them is an explicit client-issued HTTP DELETE. An...

CVE-2026-67432

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust process...

CVE-2026-67432

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust process...

CVE-2026-67432

CVE-2026-67432 affects the MCP Ruby SDK before version 0.23.0. The vulnerability exists in MCP::Server::Transports::StreamableHTTPTransport of the mcp gem, which reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust memory on th...

CVE-2026-67431

The CVE affects the MCP Ruby SDK (Model Context Protocol) prior to version 0.23.0. In MCP::Server::Transports::StreamableHTTPTransport, the session ID is not bound to a session owner, allowing a stolen session ID to cause requests (tools/call) to execute in the victim’s session. This is fixed in ...