neto

Project Neto: A Toolkit for Analysing Browser Plugins Overview Project Neto is a Python 3 package conceived to analyse and unravel hidden features of browser plugins and extensions for well-known browsers such as Firefox and Chrome. It automates the process of unzipping the packaged files to...

http-mcp-bridge

HTTP MCP Bridge This project implements an HTTP server that acts as a bridge between HTTP/1.1 requests and a remote MCP server, using the mcp python library GitHub. The main purpose of this initiative is to be able to use HTTP security tools to test remote MCP servers using the remote transport...

CVE-2024-49369

CVE-2024-49369 Overview This vulnerability leverages the Icinga JSON-RPC protocol to exploit monitored nodes running Icinga agents. By impersonating a Master/Satellite instance, attackers can potentially take over agents, execute arbitrary commands, or gain sensitive information. How to Use...

lisa.py

LLDB MCP Integration This project provides a Model-Context Protocol MCP integration for LLDB, allowing AI assistants like Claude to interact with your debugging sessions through a standardized interface. Overview The integration consists of two main components: 1. server.py - An MCP server that...

web3-decoder

Web3 Decoder Web3 Decoder is a Burp Suite Extension that helps to analyze what is going on with the operations involving smart contracts of the web3. This is mainly JSON-RPC calls to Ethereum Nodes, and nodes of other compatible networks like Polygon, Arbitrum, BSC... Download & Install Download...

mcpsnoop

Wireshark for MCP. mcpsnoop sits between your AI client and your MCP server and records every JSON-RPC frame they exchange, with no change to either side. Watch it live in your terminal, fail CI on what it finds, or send it to your tracing backend as OpenTelemetry spans. The problem The official...

EUVD-2026-93773

RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS...

RabbitMQ: JSONReader in the default JSON-RPC mapper never terminates on truncated input, causing DoS

Summary com.rabbitmq.tools.json.JSONReader.read never returns when its input ends inside a quoted string or a // line comment. Both scanners walk the input with StringCharacterIterator.next but only compare against a delimiter, so once the iterator reaches CharacterIterator.DONE ￿ they loop...

CVE-2026-106121

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners d...

DEBIAN-CVE-2026-106121

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.37.0, com.rabbitmq.tools.json.JSONReader.read fails to terminate when input ends inside a quoted string or a line comment because its string and whitespace scanners d...

web3-decoder

Web3 Decoder Web3 Decoder is a Burp Suite Extension designed for analyzing blockchain operations and smart contract interactions. It processes JSON-RPC calls to Ethereum and compatible networks including Polygon, Arbitrum, BSC, and others Block explorers API Keys Most block explorers supported,...

CVE-2026-19807

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

CVE-2026-19807 ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

CVE-2026-19807 ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

Exposure Of Data Element To The Wrong Session

Apache Struts is vulnerable to an exposure of data element to the wrong session. The vulnerability is due to per-response serialization state being shared across concurrent requests in the SMD/JSON-RPC handling of the JSON interceptor, which allows an attacker to potentially observe response...

MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

Summary ENABLEDTOOLS and TOOLSETS filters are enforced at tools/list time only. tools/call dispatches from the full unfiltered tool registry 73 tools. Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlassian is open...

PT-2026-96709

Name of the Vulnerable Software and Affected Versions ZenHive mpp versions 0.14.0 through 0.16.1 Description Improper validation of the specified quantity in the input allows a client with an open payment channel to obtain paid resources without being charged. The function accept voucher/3 in...

SUSE CVE-2026-61550

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...

Exploit for CVE-2026-94095

Netcore NBR200V2 – Remote Command Injection in the Traceroute...

CVE-2026-94050

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...