2002 matches found
MCP Server to Auto commit changes 命令注入漏洞
MCP Server to Auto commit Changes is an AI tool developed by Hypermodel Inc for automatically generating Git commit messages. Version 1.0.0 of MCP Server to Auto commit Changes contains a command injection vulnerability. This vulnerability stems from incorrect operations on the getGitChanges...
CVE-2026-4270: Improper Protection of Alternate Path
Improper Protection of Alternate Path exists in the no-access and workdir feature of the AWS API MCP Server versions = 0.2.14 and 1.3.9 on all platforms may allow the bypass of intended file access restriction and expose arbitrary local file contents in the MCP client application context. To...
CVE-2026-4192: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in AvinashBole quip-mcp-server 1.0.0. Affected by this vulnerability is the function setupToolHandlers of the file src/index.ts. Such manipulation leads to command injection. The attack may be performed from remote. The exploit has been disclosed to the public and m...
CVE-2025-69902: Improper Control of Generation of Code
A command injection vulnerability in the minimalwrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharacters...
Amazon Web Services API MCP Server 安全漏洞
The Amazon Web Services API MCP Server is an open-source large-scale context server developed by Amazon Web Services. Versions of the Amazon Web Services API MCP Server from 0.2.14 to 1.3.9 contained security vulnerabilities. These vulnerabilities were due to inadequate protection of alternate...
CVE-2025-69902
The kubectl-mcp-server software (v1.2.0) contains a command injection vulnerability within the minimal_wrapper.py component, specifically in the run_kubectl_command function. This flaw allows an attacker to execute arbitrary system commands by injecting shell metacharacters . This vulnerability p...
PT-2026-25814
🔴 CVE-2025-69902 - Critical A command injection vulnerability in the minimal wrapper.py component of kubectl-mcp-server v1.2.0 allows attackers to execute arbitrary commands via injecting arbitrary shell metacharact... https://t.co/PU0OcLfG2G https://t.co/y3eBStKQr5...
CVE-2026-4198 hypermodel-labs mcp-server-auto-commit index.ts getGitChanges command injection
A vulnerability was determined in hypermodel-labs mcp-server-auto-commit 1.0.0. Affected by this vulnerability is the function getGitChanges of the file index.ts. This manipulation causes command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may b...
CVE-2026-4198
The CVE affects hypermodel-labs/mcp-server-auto-commit 1.0.0. The vulnerability is in the getGitChanges function of index.ts, enabling command injection via a local attack. An exploit has been publicly disclosed. A patch is available (hash: f7d992c830c5f2ec5749852e66c0195e3ed7fe30) and applying i...
CVE-2026-4192
The CVE-2026-4192 entry concerns AvinashBole quip-mcp-server 1.0.0, where the function setupToolHandlers in src/index.ts is vulnerable to command injection. The vulnerability is described as exploitable remotely, with the exploit publicly disclosed and the project reportedly not responding to the...
CVE-2026-4192 AvinashBole quip-mcp-server index.ts setupToolHandlers command injection
A vulnerability has been found in AvinashBole quip-mcp-server 1.0.0. Affected by this vulnerability is the function setupToolHandlers of the file src/index.ts. Such manipulation leads to command injection. The attack may be performed from remote. The exploit has been disclosed to the public and m...
CVE-2026-4192 AvinashBole quip-mcp-server index.ts setupToolHandlers command injection
A vulnerability has been found in AvinashBole quip-mcp-server 1.0.0. Affected by this vulnerability is the function setupToolHandlers of the file src/index.ts. Such manipulation leads to command injection. The attack may be performed from remote. The exploit has been disclosed to the public and m...
CVE-2026-4192
A vulnerability has been found in AvinashBole quip-mcp-server 1.0.0. Affected by this vulnerability is the function setupToolHandlers of the file src/index.ts. Such manipulation leads to command injection. The attack may be performed from remote. The exploit has been disclosed to the public and m...
PT-2026-25567
A vulnerability has been found in AvinashBole quip-mcp-server 1.0.0. Affected by this vulnerability is the function setupToolHandlers of the file src/index.ts. Such manipulation leads to command injection. The attack may be performed from remote. The exploit has been disclosed to the public and m...
PT-2026-25573
A vulnerability was determined in hypermodel-labs mcp-server-auto-commit 1.0.0. Affected by this vulnerability is the function getGitChanges of the file index.ts. This manipulation causes command injection. The attack can only be executed locally. The exploit has been publicly disclosed and may b...
Graphiti vulnerable to Cypher Injection via unsanitized node_labels in search filters
Summary Graphiti versions before 0.28.2 contained a Cypher injection vulnerability in shared search-filter construction for non-Kuzu backends. Attacker-controlled label values supplied through SearchFilters.nodelabels were concatenated directly into Cypher label expressions without validation. In...
The Unofficial and Awesome Home Assistant MCP Server 跨站脚本漏洞
The Unofficial and Awesome Home Assistant MCP Server is an open-source component of the Unofficial Home Assistant AI Toolkit, designed to connect smart home platforms with AI assistants. Versions of the Unofficial and Awesome Home Assistant MCP Server prior to version 7.0.0 contained a cross-site...
Vulnerabilities fixed in Microsoft Azure
Microsoft has fixed vulnerabilities in several Azure components. A malicious party could exploit the vulnerabilities to impersonate another user, grant themselves elevated privileges or gain access to sensitive data. Azure Entra ID: |----------------|------|-------------------------------------| ...
CVE-2026-27825
MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. Prior to version 0.17.0, the confluencedownloadattachment MCP tool accepts a downloadpath parameter that is written to without any directory boundary enforcement. An attacker who can call this tool an...
