frida-c2-mcp

FridaC2MCP An MCP server with streamable HTTP transport that runs Frida's dynamic instrumentation entirely on-device — no client-side tooling required. This project runs directly on rooted Android and jailbroken iOS devices , exposing Frida as a set of tools callable over HTTP. Any MCP-compatible...

pentest-mcp

Pentest MCP Pentest MCP is a TypeScript MCP server for authorized security assessments. It gives a human researcher or a tool-using assessment agent one scoped interface for discovery, validation, capture, credential checks, local audit, evidence retrieval, and report preparation. Each active too...

GHSA-PQH8-4PJ7-32XX obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

Impact The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive caller http-loca...

obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

Impact The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive caller http-loca...

npm: obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback

npm: obsidian-tc HTTP transport lacks Origin/DNS-rebinding protection, enabling drive-by vault access on loopback vulnerability discovered by ? in WordPress npm obsidian-tc versions 1.3.1...

CVE-2026-57207 NetBox MCP Server: HTTP transport exposes all NetBox data without authentication

NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox too...

CVE-2026-57207

The NetBox MCP Server (prior to version 1.2.1 ) contains a vulnerability where the HTTP transport (when TRANSPORT=http is used) lacks authentication on the HTTP endpoint. This allows any client capable of reaching the port to establish a valid MCP session and gain full access to all four NetBox t...

CVE-2026-57207 NetBox MCP Server: HTTP transport exposes all NetBox data without authentication

NetBox MCP Server is a simple read-only Model Context Protocol server for NetBox. Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session and full access to all four NetBox too...

CVE-2026-91881

Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized...

CVE-2026-91881

The Dell Terraform Provider for Redfish contains a Critical Improper Certificate Validation vulnerability (CWE-295) in its HTTP transport component (versions prior to 1.6.2 ). The root cause is that TLS certificate verification is unconditionally disabled in the base HTTP transport. This allows a...

CVE-2026-91881

Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized...

EUVD-2026-101152

Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized...

CVE-2026-91881

Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized...

CVE-2026-91881: Improper Certificate Validation

Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized...

Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS : libgit2 vulnerabilities (USN-8628-1)

The remote Ubuntu 14.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8628-1 advisory. It was discovered that libgit2 incorrectly handled the Git Smart Protocol. A remote attacker...

CVE-2026-77363

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a maliciou...

CVE-2026-77363 obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a maliciou...

CVE-2026-77363

The obsidian-tc Model Context Protocol server is vulnerable to cross-origin loopback vault access in versions prior to 1.3.1 . The Streamable HTTP transport fails to validate the Host or Origin headers and lacks DNS-rebinding protection . When configured with auth.mode set to none, a malicious we...

CVE-2026-77363 obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a maliciou...

CVE-2026-77363 obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a maliciou...