CVE-2026-58201

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

CVE-2026-58201 Lokka: Azure Resource Manager URL path validation issue

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

CVE-2026-58201

Lokka (@merill/lokka), a Model Context Protocol server for Microsoft 365, is vulnerable to SSRF in versions prior to 2.1.2 . The root cause is in src/mcp/src/main.ts, where the tool constructs Azure Resource Manager request URLs via direct string concatenation with a user-controlled path value. A...

CVE-2026-58201 Lokka: Azure Resource Manager URL path validation issue

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

CVE-2026-58201 Lokka: Azure Resource Manager URL path validation issue

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

EUVD-2026-78934

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

PT-2026-92124

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

CVE-2026-58201: Server-Side Request Forgery (SSRF)

Lokka is a Model Context Protocol server for Microsoft 365, including Microsoft Graph and other services. Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the management.azure.com base URL. A specially...

GHSA-G2GW-Q38M-VJFC Lokka: Azure Resource Manager URL path validation issue

Lokka versions prior to 2.1.2 constructed Azure Resource Manager request URLs using direct string concatenation with user-controlled path input. Specially crafted path values could alter URL authority parsing and cause Azure Resource Manager bearer tokens to be sent to an unintended host. Version...

Server-side Request Forgery (SSRF)

Overview @merill/lokka is a Lokka is a Model Context Protocol MCP server for Microsoft Graph. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via improper validation of user-supplied input in the process constructing Azure Resource Manager request URLs. An...

EUVD-2021-31313

Malicious code in bioql PyPI...

CVE-2021-44480

Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers who know the SIM phone number and password to listen to a device's surroundings via a callback in an SMS command, as demonstrated by the 123456 and 523681 default passwords...

CVE-2021-44480

Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers who know the SIM phone number and password to listen to a device's surroundings via a callback in an SMS command, as demonstrated by the 123456 and 523681 default passwords...

CVE-2021-44480

Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers who know the SIM phone number and password to listen to a device's surroundings via a callback in an SMS command, as demonstrated by the 123456 and 523681 default passwords...

Default credentials

Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers who know the SIM phone number and password to listen to a device's surroundings via a callback in an SMS command, as demonstrated by the 123456 and 523681 default passwords...

CVE-2021-44480

The CVE-2021-44480 entry concerns the Wokka Lokka Q50 smartwatch. Affected device: Wokka Lokka Q50 (through 2021-11-30). Vulnerable component/flow: a vulnerability in the device’s SMS/callback mechanism that lets a remote attacker — who knows the SIM phone number and the default password — listen...

CVE-2021-44480: Cleartext Transmission of Sensitive Information

Wokka Lokka Q50 devices through 2021-11-30 allow remote attackers who know the SIM phone number and password to listen to a device's surroundings via a callback in an SMS command, as demonstrated by the 123456 and 523681 default passwords...

Wokka Lokka Q50 信息泄露漏洞

The Wokka Lokka Q50 is a children's smartwatch from Wokka Lokka USA. The Wokka Lokka Q50 suffers from an information disclosure vulnerability that originates from allowing a remote attacker knowing the SIM phone number and passcode to listen to the device's surroundings via callbacks in SMS...