cmcp

cMCP: 機密MCPランタイム MCPツールポリシーをTEE内で強制実行。管理対象のエージェントからは到達不能な場所で動作 クイックスタート · アーキテクチャ · 設定 · CLI · 変更履歴 開発者プレビュー - 2026年6月23日のConfidential Computing Summitで発表されました。v1.0までに破壊的変更が発生する可能性があります。現在提供されている機能とロードマップ上の機能の正確な内訳については、STATUS.mdを参照してください。 cMCP（Confidential MCP...

ai-tool-poisoning-guard

ai-tool-poisoning-guard 适用于 Claude Code、Codex 和 Cursor 的最低安全基线规则。这条免费规则弥补了各工具内置审查中的真实缺口。完整规则集 + 实施指南：Gumroad 链接 — 即将推出 。 你的 AI 编程助手会审查代码。但它不会审查随工具一起出现的那句话。 Claude Code、Codex 和 Cursor 都内置了某种形式的安全审查。但默认情况下，它们都不会将 MCP 工具描述 ——纯自然语言文本——视为需要与代码同等审查力度的输入面。 缺口所在： 当你添加一个 MCP...

CVE-2026-94046

A weakness has been identified in 0215AndrewFeng ACE-MCP up to 4.10.8. The affected element is the function getfilesnippet of the file getFileSnippet.ts of the component MCP Tool. Executing a manipulation of the argument projectRootPath/filePath can lead to path traversal. The attack may be...

CVE-2026-94046

ACE-MCP (version up to 4.10.8) contains a path traversal vulnerability in the get_file_snippet function of getFileSnippet.ts within its MCP Tool component. The root cause is that isPathInsideProjectRoot only validates that filePath does not escape the projectRootPath, but projectRootPath itself i...

CVE-2026-5029-Exploit

🔥 CVE-2026-5029 — Code Runner MCP Server RCE（リモートコード実行） run-code MCPツールを介した未認証リモートコード実行 CVE-2026-5029の概念実証（PoC）エクスプロイト —--transport httpでサーバーを実行した際に MCPツールを介してトリガーされる、Code Runner MCP Serverの重大な未認証リモートコード実行（RCE）脆弱性。...

CVE-2026-85666

A flaw was found in OGX, an OpenAI-compatible server. A remote, unauthenticated attacker can exploit a Server-Side Request Forgery SSRF vulnerability by manipulating the serverurl parameter within MCP tool definitions. This allows the attacker to force the server to connect to arbitrary internal...

CVE-2026-88938

knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host. Attackers can supply absolute paths or relative traversal sequences to the path argument and retrieve full file contents fr...

CVE-2026-88938 knowns through 0.33.0 Path Traversal via code.find MCP tool

knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host. Attackers can supply absolute paths or relative traversal sequences to the path argument and retrieve full file contents fr...

CVE-2026-88938 knowns through 0.33.0 Path Traversal via code.find MCP tool

knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host. Attackers can supply absolute paths or relative traversal sequences to the path argument and retrieve full file contents fr...

EUVD-2026-75581

knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host. Attackers can supply absolute paths or relative traversal sequences to the path argument and retrieve full file contents fr...

CVE-2026-88938

knowns through version 0.33.0 is affected by a path traversal vulnerability in the code.find MCP tool . The tool fails to confine its path argument to the project root, allowing an AI agent session to supply absolute paths or relative traversal sequences and retrieve full file contents from outsi...

CVE-2026-88938 knowns through 0.33.0 Path Traversal via code.find MCP tool

knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host. Attackers can supply absolute paths or relative traversal sequences to the path argument and retrieve full file contents fr...

PT-2026-89479

🚨 CVE-2026-88938 knowns through 0.33.0 fails to confine the path argument of the code.find MCP tool to the project root, allowing AI agent sessions to read source files anywhere on the host. Attackers can supply absolute paths or relative traversal sequences to the path argument and retrieve full...

functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

MCP setfunctypeversion Package Alias RCE via Unsanitized pnpm install + Dynamic Import Summary The setfunctypeversion MCP tool in functype-mcp-server accepts an unconstrained version string, interpolates it directly into an npm package specifier functype@, and installs it via pnpm add without any...

GHSA-WCJJ-9M6G-2FR2 functype-mcp-server: MCP `set_functype_version` Package Alias RCE via Unsanitized pnpm install + Dynamic Import

MCP setfunctypeversion Package Alias RCE via Unsanitized pnpm install + Dynamic Import Summary The setfunctypeversion MCP tool in functype-mcp-server accepts an unconstrained version string, interpolates it directly into an npm package specifier functype@, and installs it via pnpm add without any...

EUVD-2026-72555

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files...

CVE-2026-86439

knowns versions before 0.30.0 fail to validate filesystem paths in MCP tool arguments, allowing attackers to read, create, overwrite and delete files outside the project directory. Attackers can supply path arguments containing directory traversal sequences to access arbitrary Markdown files...

CVE-2026-19300 Langflow is vulnerable to information disclosure due to cross-user MCP tool cache collision and incomplete secret scrubbing on public flows

IBM Langflow OSS 1.0.0 through 1.11.2 could allow a remote attacker to obtain sensitive information due to incomplete scrubbing of sensitive credential fields...

CVE-2026-19300

IBM Langflow OSS versions 1.0.0 through 1.11.2 are affected by an information disclosure vulnerability in the unauthenticated public flow endpoint. The endpoint uses a heuristic denylist to scrub stored secrets from node templates, but omits fields such as Authentication, X-Session-Id, App-Key, a...

CVE-2026-85666

OGX formerly Llama Stack, affected at commit fbe8e0f contains an unauthenticated server-side request forgery vulnerability in the OpenAI-compatible POST /v1/responses endpoint. MCP tool definitions accept a serverurl parameter along with headers and authorization values that is fetched server-sid...