61 matches found
EUVD-2026-117156
tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients...
GHSA-H7C4-Q426-7JH9 tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
Summary The HTTP mode of @tsparticles/mcp-server creates a single stateful StreamableHTTPServerTransport instance and reuses it for all clients. The first anonymous client that initializes the MCP endpoint claims the shared transport state, and later clients cannot create their own sessions. This...
tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
Summary The HTTP mode of @tsparticles/mcp-server creates a single stateful StreamableHTTPServerTransport instance and reuses it for all clients. The first anonymous client that initializes the MCP endpoint claims the shared transport state, and later clients cannot create their own sessions. This...
EUVD-2026-117153
tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS...
CVE-2026-63655
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer without a...
CVE-2026-76893
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...
CVE-2026-76893 tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...
CVE-2026-76893 tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...
CVE-2026-76893 tsParticles: A single anonymous MCP session can monopolize HTTP mode and deny new clients
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...
CVE-2026-76893
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...
CVE-2026-76893
The tsParticles TypeScript library (specifically the @tsparticles/mcp-server component) is vulnerable in versions prior to 4.3.2 . Due to a flaw in the HTTP mode , the server reuses a single stateful StreamableHTTPServerTransport for all clients. An unauthenticated client can claim this shared st...
CVE-2026-63655
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer without a...
PT-2026-137223
Name of the Vulnerable Software and Affected Versions @tsparticles/mcp-server versions prior to 4.3.2 Description The HTTP mode of the server reuses a single stateful StreamableHTTPServerTransport for every client. An unauthenticated client can claim the shared transport state by sending an initi...
CVE-2026-76893: tsparticles, @tsparticles: tsParticles is a TypeScript library for creating highly customizable particle animations
tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...
Nacho Sanchez Gines Gearboy authorization issue vulnerability
Versions of Nacho Sanchez Gines Gearboy prior to 3.8.7 contain an authorization issue vulnerability. This vulnerability arises because its MCP HTTP mode accepts unauthenticated MCP requests; the socket is bound to INADDRANY without checking Authorization, Host, and Origin parameters. As a result,...
CVE-2026-54446 NetLicensing MCP Server: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode
NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.6, network-reachable HTTP transport requests to /mcp that omit x-netlicensing-api-key, Authorization: Bearer, and the apikey...
CVE-2026-38924
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a...
CVE-2026-38924
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a...
CVE-2026-38924
CVE-2026-38924 affects Oraios AI Serena prior to 1.0.0 , where the MCP server in HTTP mode binds its listen address to 0.0.0.0 (all interfaces) rather than 127.0.0.1. The supplier acknowledged this as a "potential security hazard," though documentation at the time recommended running Serena in a ...
EUVD-2026-77175
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a...