PT-2026-35828

Name of the Vulnerable Software and Affected Versions eiceblue spire-pdf-mcp-server version 0.1.1 Description A flaw in the PDF File Handler component allows for remote path traversal. This occurs when the filepath argument is manipulated within the get pdf path function located in the src/spire...

SQLite MCP Server 注入漏洞

SQLite MCP Server is a lightweight tool developed by Doo Bui, an individual developer, that allows large models to operate SQLite databases autonomously. Versions of SQLite MCP Server 0.1.0 and earlier contained a vulnerability due to incorrect handling of the outputfilename parameter in the...

Notes MCP server 路径遍历漏洞

Notes MCP Server is a text content collaboration management tool developed by Edvard Lindelof. Versions of Notes MCP Server prior to 0.1.4 contained a path traversal vulnerability. This vulnerability stemmed from incorrect handling of parameters rootdir and path in the notesmcp.py file, which cou...

PT-2026-35827

Name of the Vulnerable Software and Affected Versions eiceblue spire-doc-mcp-server version 1.0.0 Description A path traversal issue exists in the get doc path function within the src/spire doc mcp/api/base.py file. This occurs when the document name argument is manipulated, allowing a remote...

Spire.Doc MCP Server 路径遍历漏洞

Spire.Doc MCP Server is a tool provided by E-iceblue Product Family for individual developers, allowing them to work with Word documents without the need for Microsoft Word. Version 0.1.1 of Spire.Doc MCP Server contains a path traversal vulnerability. This vulnerability stems from the getpdfpath...

PT-2026-35576

Name of the Vulnerable Software and Affected Versions dvladimirov MCP versions prior to 0.1.1 Description A command injection flaw exists in the Git Search API component within the GitSearchRequest function of the mcp server.py file. A remote attacker can execute this by manipulating the repo url...

MCP Server with OpenAI, Git, Filesystem, and Prometheus Integration 注入漏洞

MCP Server with OpenAI, Git, Filesystem, and Prometheus Integration is an integrated model control plane server developed by DVladimirov, which integrates OpenAI, Git, a file system, and Prometheus. Versions of MCP Server with OpenAI, Git, Filesystem, and Prometheus Integration prior to 0.1.0 hav...

Papers MCP Server 路径遍历漏洞

Papers MCP Server is a scholarly paper management and MCP protocol service tool developed by Byron Duarte. There is a path traversal vulnerability in Papers MCP Server. This vulnerability stems from the incorrect handling of the topic parameter in the searchpapers function in the src/main.py file...

PT-2026-35574

Name of the Vulnerable Software and Affected Versions duartium papers-mcp-server version 9ceb3812a6458ba7922ca24a7406f8807bc55598 Description A path traversal issue exists in the search papers function within the src/main.py file. This occurs when the topic argument is manipulated, allowing a...

CVE-2026-7157

A flaw has been found in disler aider-mcp-server up to b2516fa466d0d851932da92ee6d0e66946db9efc. Affected by this vulnerability is an unknown functionality of the file src/aidermcpserver/server.py of the component aideraicode. This manipulation of the argument relativeeditablefiles causes command...

CVE-2026-7157 disler aider-mcp-server aider_ai_code server.py command injection

A flaw has been found in disler aider-mcp-server up to b2516fa466d0d851932da92ee6d0e66946db9efc. Affected by this vulnerability is an unknown functionality of the file src/aidermcpserver/server.py of the component aideraicode. This manipulation of the argument relativeeditablefiles causes command...

CVE-2026-7157

A flaw has been found in disler aider-mcp-server up to b2516fa466d0d851932da92ee6d0e66946db9efc. Affected by this vulnerability is an unknown functionality of the file src/aidermcpserver/server.py of the component aideraicode. This manipulation of the argument relativeeditablefiles causes command...

CVE-2026-7157 disler aider-mcp-server aider_ai_code server.py command injection

A flaw has been found in disler aider-mcp-server up to b2516fa466d0d851932da92ee6d0e66946db9efc. Affected by this vulnerability is an unknown functionality of the file src/aidermcpserver/server.py of the component aideraicode. This manipulation of the argument relativeeditablefiles causes command...

CVE-2026-7149

CVE-2026-7149 affects dexhunter kaggle-mcp: path traversal vulnerability in src/kaggle_mcp/server.py::prepare_kaggle_dataset caused by manipulating the competition_id. Attack is remote and publicly disclosed; no explicit affected version details can be given due to rolling-release policy. Project...

PT-2026-35530

A flaw has been found in disler aider-mcp-server up to b2516fa466d0d851932da92ee6d0e66946db9efc. Affected by this vulnerability is an unknown functionality of the file src/aider mcp server/server.py of the component aider ai code. This manipulation of the argument relative editable files causes...

Auto Favicon MCP Server 代码问题漏洞

The Auto Favicon MCP Server is a tool developed by Yuey, a personal developer, for automatically generating website icons. The Auto Favicon MCP Server f189116a9259950c2393f114dbcb94dde0ad864b and previous versions have code vulnerabilities. These vulnerabilities stem from improper handling of the...

Aider MCP Server 注入漏洞

Aider MCP Server is an AI coding task unloading and collaboration tool developed by IndyDevDan. There is a vulnerability in Aider MCP Server, which stems from an unknown function in the aideraicode component file src/aidermcpserver/server.py. This function improperly handles the parameter...

CVE-2026-7061 Toowiredd chatgpt-mcp-server MCP/HTTP docker.service.ts os command injection

A weakness has been identified in Toowiredd chatgpt-mcp-server up to 0.1.0. Affected by this issue is some unknown functionality of the file src/services/docker.service.ts of the component MCP/HTTP. This manipulation causes os command injection. Remote exploitation of the attack is possible. The...

EUVD-2026-25731

A weakness has been identified in Toowiredd chatgpt-mcp-server up to 0.1.0. Affected by this issue is some unknown functionality of the file src/services/docker.service.ts of the component MCP/HTTP. This manipulation causes os command injection. Remote exploitation of the attack is possible. The...

CVE-2026-7061

A weakness has been identified in Toowiredd chatgpt-mcp-server up to 0.1.0. Affected by this issue is some unknown functionality of the file src/services/docker.service.ts of the component MCP/HTTP. This manipulation causes os command injection. Remote exploitation of the attack is possible. The...