PT-2026-49757

Name of the Vulnerable Software and Affected Versions OpenClaw versions prior to 2026.5.12 Description An information disclosure issue exists in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP...

PT-2026-50175

Name of the Vulnerable Software and Affected Versions n8n versions prior to 2.25.7 n8n versions prior to 2.26.2 Description When @n8n/mcp-browser is operated in HTTP transport mode using the --transport http flag, the MCP endpoint allows session initialization and tool invocation requests without...

EUVD-2026-36984

Unauthenticated Broken Access Control in Royal MCP = 1.4.2 versions...

CVE-2026-40775

Unauthenticated Broken Access Control in Royal MCP = 1.4.2 versions...

arikaim (>=0.5.6, <=0.5.11), ellar (>=0.7.0, <=0.7.3) +3 more potentially affected by CVE-2026-54282 via starlette (0.37.1)

starlette PYPI version 0.37.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - arikaim =0.5.6, =0.7.0, =4.4.4, =0.1.2, =0.1.1, =0.1.12 Source cves: CVE-2026-54282 Source advisory: OSV:GHSA-JP82-JPQV-5VV3...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.6) +1005 more potentially affected by CVE-2026-53539 via python-multipart (>=0.0.5, <=0.0.29)

python-multipart PYPI version =0.0.5, =0.5.3, =0.1.0, =0.2.1, =0.2.0, =0.5.1.dev0, =3.2.0, =1.5.2, =0.1.1, =0.1.4b1, =1.0.0, =1.5.5 - agbenchmark 0.0.10 and more Source cves: CVE-2026-53539 Source advisory: OSV:GHSA-5RVQ-CXJ2-64VF...

CVE-2026-40775 WordPress Royal MCP plugin <= 1.4.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Royal MCP = 1.4.2 versions...

CVE-2026-40775 WordPress Royal MCP plugin <= 1.4.2 - Broken Access Control vulnerability

Unauthenticated Broken Access Control in Royal MCP = 1.4.2 versions...

arikaim (>=0.5.6, <=0.5.11), ellar (>=0.7.0, <=0.7.3) +3 more potentially affected by CVE-2026-48818 via starlette (0.37.1)

starlette PYPI version 0.37.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - arikaim =0.5.6, =0.7.0, =4.4.4, =0.1.2, =0.1.1, =0.1.12 Source cves: CVE-2026-48818 Source advisory: OSV:GHSA-WQP7-X3PW-XC5R...

esmerald (1.2.3), htagweb (>=0.10.0, <=0.42.3) +3 more potentially affected by CVE-2026-48818 via starlette (0.29.0)

starlette PYPI version 0.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 1.2.3 - htagweb =0.10.0, =1.0.0, =1.0.1 - starlette-authlib 0.1.27 - starlette-bridge 0.2.0 Source cves: CVE-2026-48818 Source...

arikaim (>=0.5.6, <=0.5.11), ellar (>=0.7.0, <=0.7.3) +3 more potentially affected by CVE-2026-48817 via starlette (0.37.1)

starlette PYPI version 0.37.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - arikaim =0.5.6, =0.7.0, =4.4.4, =0.1.2, =0.1.1, =0.1.12 Source cves: CVE-2026-48817 Source advisory: OSV:GHSA-X746-7M8F-X49C...

fusion (0.1.0), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-48817 via starlette (0.47.0)

starlette PYPI version 0.47.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fusion 0.1.0 - geo-importer =0.0.1b1, =0.3.0, =0.1.2, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-48817 Source advisory:...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.6) +1537 more potentially affected by CVE-2026-48522 via pyjwt (>=2.0.0, <=2.12.1)

pyjwt PYPI version =2.0.0, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.8, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-48522 Source advisory: OSV:GHSA-993G-76C3-P5M4...

10xscale-agentflow-cli (0.1.5), 360solutions-bc-mcp (>=0.5.3, <=0.5.6) +1537 more potentially affected by CVE-2026-48524 via pyjwt (>=2.0.0, <=2.12.1)

pyjwt PYPI version =2.0.0, =0.5.3, =2.3.0, =0.1.0, =1.0.0, =1.8.8, =1.1.0rc1, =1.0.1, =0.1.0.post1, =0.1.5, =2.3.10rc8, =0.0.9rc17, =1.2.0, =1.2.1 - adminui 1.5.2 and more Source cves: CVE-2026-48524 Source advisory: OSV:GHSA-FHV5-28VV-H8M8...

PT-2026-49419

Unauthenticated Broken Access Control in Royal MCP = 1.4.2 versions...

PT-2026-49607

Name of the Vulnerable Software and Affected Versions LangBot versions 4.10.7 and earlier Description Authenticated users can execute arbitrary commands on the server with the privileges of the LangBot service due to an inadequate authorization boundary when adding or changing an STDIO MCP server...

CVE-2026-40775: Missing Authorization

Unauthenticated Broken Access Control in Royal MCP = 1.4.2 versions...

GHSA-76G7-M3XW-X9GR MCP Toolbox for Databases has an Origin Validation Error

The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "--allowed-hosts" flag was introduced...

MCP Toolbox for Databases has an Origin Validation Error

The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new "--allowed-hosts" flag was introduced...

Origin Validation Error

Overview Affected versions of this package are vulnerable to Origin Validation Error in the handling of the Origin header on incoming connections. An attacker can bypass access restrictions by exploiting DNS rebinding techniques, potentially gaining unauthorized access to server resources...