EUVD-2026-68103

argocd-mcp 0.8.0 binds its HTTP transport to every network interface and accepts MCP sessions without requiring caller credentials when ARGOCDAPITOKEN is configured. Attackers who can reach the listener can invoke the full tool surface using the operator's stored token to create applications,...

hexstrike-ai

HexStrike AI MCP Agents v6.0 Piattaforma di automazione cybersecurity MCP basata sull'IA Framework MCP avanzato per penetration testing basato sull'IA, con oltre 150 strumenti di sicurezza e 12+ agenti AI autonomi 📋 Novità • 🏗️ Architettura • 🚀 Installazione • 🛠️ Funzionalità • 🤖 Agenti AI • 📡...

cve-mcp-server

🛡️ CVE MCP Server Intelligence di sicurezza basata sull'AI a portata di mano — 28 strumenti + un orchestratore monochiamatatriagecve, 24 sorgenti di dati, un unico protocollo. Un server Model Context Protocol MCP di livello produttivo che trasforma Claude in un analista di sicurezza a tutto...

Gideon

root@kitploit: ██████╗ ██╗██████╗ ███████╗ ██████╗ ███╗ ██╗ ██╔════╝ ██║██╔══██╗██╔════╝██╔═══██╗████╗ ██║ ██║ ███╗██║██║ ██║█████╗ ██║ ██║██╔██╗ ██║ ██║ ██║██║██║ ██║██╔══╝ ██║ ██║██║╚██╗██║ ╚██████╔╝██║██████╔╝███████╗╚██████╔╝██║ ╚████║ ╚═════╝ ╚═╝╚═════╝ ╚══════╝ ╚═════╝ ╚═╝ ╚═══╝ Agente...

refreshing-mcp-tool

यह वास्तव में पूरा या तैयार नहीं है, लेकिन मैं कोड को चेक इन करवाना चाहता था। यह मूल रूप से F5 के डेटाबेस प्रोटोकॉल "mcp" को लागू करता है, जो UNIX domain socket के माध्यम से काम करता है। इसका मतलब है कि इनमें से किसी का उपयोग करने से पहले आपको F5 डिवाइस पर शेल की आवश्यकता होती है। आप आमतौर पर...

diaphora-mcp

Leggi in russo Diaphora MCP Diaphora MCP è un server MCP Model Context Protocol per il diffing automatico di binari. Collega Diaphora il motore di diffing e IDA Pro il disassemblatore tramite il protocollo MCP, consentendo ad agenti AI come Claude Code di eseguire confronti di file binari, trovar...

threat-modeling-mcp-server

Server MCP per Threat Modeling Un server Model Context Protocol MCP per un'analisi completa delle minacce con validazione automatica del codice. Indice Panoramica Prompt di Avvio Rapido ed esempi su come effettuare il threat modeling con questo server MCP Caratteristiche Principali Prerequisiti...

burp-ai-agent

Custom AI Agent Il ponte tra Burp Suite e l'IA moderna. Nota sul nome: questa estensione è pubblicata come Custom AI Agent in precedenza Burp AI Agent. È stata rinominata per conformarsi ai requisiti di denominazione del BApp Store di PortSwigger e per evitare confusione con il provider Burp AI...

Authentication Bypass Using an Alternate Path or Channel

Overview litellm is a Library to easily interface with LLM API providers Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel via the OAuth2 passthrough fallback in MCPRequestHandler.processmcprequest in...

CVE-2026-32625

LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.8.3, the Model Context Protocol MCP server integration resolves $VAR placeholders against the server's process.env during Zod schema validation of user-supplied MCP server URLs. Any...

CVE-2026-5323

The CVE-2026-5323 entry affects priyankark a11y-mcp (up to 1.0.5), specifically the A11yServer function in src/index.js, causing a server-side request forgery. Exploitation requires a local position. An exploit has been made public. Upgrade to version 1.0.6 to resolve, with patch id e3e11c9e8482b...

Interpretation Conflict

Overview Affected versions of this package are vulnerable to Interpretation Conflict in the JSON-RPC and MCP protocol message parsing. An attacker can bypass intermediary inspection or cause cross-implementation inconsistencies by sending protocol messages with non-standard field casing or Unicod...

CVE-2026-27896

The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method", "METHOD", etc...

CVE-2026-27896

The CVE-2026-27896 concerns the Go MCP SDK, affected in versions prior to 1.3.1, where Go’s json.Unmarshal (case-insensitive field matching) could accept non-standard JSON-RPC/MCP field casing. This violates JSON-RPC 2.0’s exact field names and could allow messages to bypass intermediary inspecti...

PT-2026-22069

Name of the Vulnerable Software and Affected Versions Go MCP SDK versions prior to 1.3.1 Description The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing. Go's standard library performs case-insensitive matching of JSON keys to struct field tags,...

CVE-2025-61929 Cherry Studio allows one-click on a specific URL to cause a command to execute

Cherry Studio is a desktop client that supports for multiple LLM providers. Cherry Studio registers a custom protocol called cherrystudio://. When handling the MCP installation URL, it parses the base64-encoded configuration data and directly executes the command within it. In the files...

EUVD-2025-33778

Cherry Studio is a desktop client that supports for multiple LLM providers. Cherry Studio registers a custom protocol called cherrystudio://. When handling the MCP installation URL, it parses the base64-encoded configuration data and directly executes the command within it. In the files...