mcpsnoop

Wireshark for MCP. mcpsnoop sits between your AI client and your MCP server and records every JSON-RPC frame they exchange, with no change to either side. Watch it live in your terminal, fail CI on what it finds, or send it to your tracing backend as OpenTelemetry spans. The problem The official...

CVE-2026-89101 Everest Forms <= 3.6.2 - Insecure Direct Object Reference to Authenticated (Custom+) Arbitrary Entry/Form Disclosure and Deletion via MCP /tools/call JSON-RPC Endpoint

The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.6.2 via the getentry due to missing validation on a user controlled key. This makes it possible...

neto

Project Neto: A Toolkit for Analysing Browser Plugins Overview Project Neto is a Python 3 package conceived to analyse and unravel hidden features of browser plugins and extensions for well-known browsers such as Firefox and Chrome. It automates the process of unzipping the packaged files to...

lisa.py

LLDB MCP Integration This project provides a Model-Context Protocol MCP integration for LLDB, allowing AI assistants like Claude to interact with your debugging sessions through a standardized interface. Overview The integration consists of two main components: 1. server.py - An MCP server that...

CVE-2026-111770 Model Context Protocol TypeScript SDK: Shared transport or server instances delivered one HTTP client's messages to another

The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 2.0.0 until 2.3.0 in @modelcontextprotocol/server, applications that shared one stateless HTTP transport or one McpServer or Server instance among multiple clients...

CVE-2026-111770

The @modelcontextprotocol/server TypeScript SDK (versions 2.0.0 through 2.2.0 ) contains a race condition where shared stateless HTTP transports or server instances can deliver messages to the wrong clients. This occurs because messages are matched using only the JSON-RPC request identifier , and...

CVE-2026-54146

OpenHuman is an open-source agent harness available as a desktop application and Rust library. From 0.53.15 before 0.57.5 on macOS, coreprocess.rs in the Tauri desktop process publishes the per-launch OPENHUMANCORETOKEN bearer credential in its process environment even though the core now runs as...

CVE-2026-54145

OpenHuman is an open-source agent harness available as a desktop application and Rust library. In affected versions before 0.57.5, the approval gate uses the JSON-RPC bearer token as an approval session identifier. This exposes the credential through persisted approval records, events, debug logs...

CVE-2026-76894

CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the DataStore table UI in src/resources/datastore-table-ui.ts accepts window message events without validating event.origin and sends JSON-RPC messages through postMessage with a wildcard target origin. A frame that...

CVE-2026-120314

Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Beare...

CVE-2026-120314 Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations

Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Beare...

CVE-2026-120314

The Network-AI software (versions 5.14.0 before 5.15.5 ) is vulnerable to a missing authentication flaw in the A2AServer class. This vulnerability occurs when no secret is configured, allowing unauthenticated attackers to access task operations via JSON-RPC requests. Specifically, an attacker can...

CVE-2026-120314 Network-AI 5.14.0 before 5.15.5 Missing Authentication in A2AServer Task Operations

Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Beare...

EUVD-2026-115003

Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Beare...

CVE-2026-120314: Jovancoding Network-AI: Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows…

Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Beare...

PT-2026-135261

Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows unauthenticated attackers to access task operations when no secret is configured. Attackers can send JSON-RPC requests to tasks/send, tasks/get, and tasks/cancel without a Beare...

web3-decoder

Web3 Decoder Web3 Decoder is a Burp Suite Extension that helps to analyze what is going on with the operations involving smart contracts of the web3. This is mainly JSON-RPC calls to Ethereum Nodes, and nodes of other compatible networks like Polygon, Arbitrum, BSC... Download & Install Download...

CVE-2024-49369

CVE-2024-49369 Overview This vulnerability leverages the Icinga JSON-RPC protocol to exploit monitored nodes running Icinga agents. By impersonating a Master/Satellite instance, attackers can potentially take over agents, execute arbitrary commands, or gain sensitive information. How to Use...

http-mcp-bridge

HTTP MCP Bridge This project implements an HTTP server that acts as a bridge between HTTP/1.1 requests and a remote MCP server, using the mcp python library GitHub. The main purpose of this initiative is to be able to use HTTP security tools to test remote MCP servers using the remote transport...

FreeBSD : metasploit -- multiple vulnerabilities (4488c0db-d45b-11f1-bae2-3497f65b111b)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 4488c0db-d45b-11f1-bae2-3497f65b111b advisory. Rapid7 published security advisories for issues fixed in releases 6.5.2 through 6.5.7. The...