Summarization Functions 操作系统命令注入漏洞

Summarization Functions is an intelligent text summarization server developed by Braffolk’s individual developer. Versions of Summarization Functions prior to 0.1.5 had a vulnerability related to operating system command injection. This vulnerability stemmed from improper handling of the command...

Vale MCP Server 操作系统命令注入漏洞

The Vale MCP Server is an AI assistant protocol server with integrated syntax checking capabilities, developed by Chris Chinchilla. Versions of the Vale MCP Server prior to 0.1.0 contained a vulnerability related to operating system command injection. This vulnerability stemmed from improper...

Exploit for Cross-site Scripting in Exclusiveaddons Exclusive_Addons_For_Elementor

WP-Hunter MCP - Autonomous Bug Bounty Hunting MCP SERVER...

Command Injection

Overview code-screenshot-mcp is a MCP server for generating beautiful code screenshots directly from Claude Affected versions of this package are vulnerable to Command Injection through request parameters. An attacker can execute arbitrary operating system commands by sending specially crafted HT...

CVE-2026-32211

Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network...

Google Research MCP Server 代码问题漏洞

The Google Research MCP Server is an AI assistant server developed by mixelpixx for providing web search and content extraction functions. There are code vulnerabilities in the Google Research MCP Server, which stem from improper handling of parameter URLs. These vulnerabilities may lead to...

FastMCP 安全漏洞

FastMCP is a MCP server building software developed by Jeremiah Lowin. Versions of FastMCP prior to 3.2.0 contained security vulnerabilities; these vulnerabilities stemmed from incorrect user authorization verification by OAuthProxy, which could lead to rogue agent attacks...

CVE-2026-32211

Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network...

CVE-2026-5346 huimeicloud hm_editor image-to-base64 Endpoint mcp-server.js client.get server-side request forgery

A vulnerability was determined in huimeicloud hmeditor up to 2.2.3. Impacted is the function client.get of the file src/mcp-server.js of the component image-to-base64 Endpoint. Executing a manipulation of the argument url can lead to server-side request forgery. It is possible to launch the attac...

CVE-2026-5346

The CVE-2026-5346 entry affects huimeicloud hm_editor version up to 2.2.3. The vulnerability is in the image-to-base64 Endpoint, specifically the file src/mcp-server.js, in the function client.get. By manipulating the url argument, an attacker can trigger a server-side request forgery remotely. P...

HmEditor 代码问题漏洞

HmEditor is an intelligent medical electronic health record editor developed under open source by huimeicloud. Versions of HmEditor 2.2.3 and earlier contained code vulnerabilities. These vulnerabilities stemmed from incorrect handling of the parameter url in the client.get function of the...

KLA90966 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to obtain sensitive information, bypass security restrictions, gain privileges. Below is a complete list of vulnerabilities: 1. An information disclosure vulnerability in Azure MCP Server can...

GHSA-98F9-FQG5-HVQ5 PraisonAI Has Authentication Bypass via OAuthManager.validate_token()

Summary OAuthManager.validatetoken returns True for any token not found in its internal store, which is empty by default. Any HTTP request to the MCP server with an arbitrary Bearer token is treated as authenticated, granting full access to all registered tools and agent capabilities. Details...

MAL-2026-2328 Malicious code in mcp-server-todo (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f426e9e8a841f37f765614c031a1b4f56bb7ee1c8d5ed51b2aeb27a261edce9 The package mcp-server-todo was found to contain malicious code. Source: ghsa-malware d2e2326574c0d2811c6c20ff1523ad04fc4bdb6f062080751acdca4a592c68b...

Malicious Package

Overview mcp-server-todo is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

PT-2026-29829

Name of the Vulnerable Software and Affected Versions PraisonAI affected versions not specified Description A flaw exists in the token validation process, where the OAuthManager.validate token function incorrectly returns True for any token not found in its internal store. This store is empty by...

CVE-2026-34200

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to...

CVE-2026-34200 Nhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to...

CVE-2026-34200

CVE-2026-34200 affects the Nhost CLI MCP server prior to v1.41.0. When explicitly configured to listen on a network port, the MCP server applies no inbound authentication and does not enforce strict CORS, allowing a malicious website on the same machine to issue cross-origin requests and use loca...

CVE-2026-34200 Nhost CLI MCP Server: Missing Inbound Authentication on Explicitly Bound Network Port

Nhost is an open source Firebase alternative with GraphQL. Prior to version 1.41.0, The Nhost CLI MCP server, when explicitly configured to listen on a network port, applies no inbound authentication and does not enforce strict CORS. This allows a malicious website visited on the same machine to...