Arbitrary Command Injection

Overview stata-mcp is a Let LLM help you achieve your regression analysis with Stata Affected versions of this package are vulnerable to Arbitrary Command Injection via the logfilename parameter in the Stata command wrapper. An attacker can execute arbitrary commands and write files outside the...

esmerald (1.2.3), htagweb (>=0.10.0, <=0.42.3) +3 more potentially affected by CVE-2026-48710 via starlette (0.29.0)

starlette PYPI version 0.29.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - esmerald 1.2.3 - htagweb =0.10.0, =1.0.0, =1.0.1 - starlette-authlib 0.1.27 - starlette-bridge 0.2.0 Source cves: CVE-2026-48710 Source...

brave-mcp-langchain (>=0.1.0, <=0.2.0), bughunter-akabarki76 (0.3.24) +7 more potentially affected by CVE-2026-48710 via starlette (0.47.1)

starlette PYPI version 0.47.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - brave-mcp-langchain =0.1.0, =1.3.0rc1, =0.2.6, =0.3.0 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

fusion (0.1.0), geo-importer (>=0.0.1b1, <=0.0.1b914) +4 more potentially affected by CVE-2026-48710 via starlette (0.47.0)

starlette PYPI version 0.47.0 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - fusion 0.1.0 - geo-importer =0.0.1b1, =0.3.0, =0.1.2, =0.1.0, =0.1.0, =0.1.3 Source cves: CVE-2026-48710 Source advisory:...

arikaim (>=0.5.6, <=0.5.11), ellar (>=0.7.0, <=0.7.3) +3 more potentially affected by CVE-2026-48710 via starlette (0.37.1)

starlette PYPI version 0.37.1 is affected by a known vulnerability. The following packages have a transitive dependency on starlette and may be impacted: - arikaim =0.5.6, =0.7.0, =4.4.4, =0.1.2, =0.1.1, =0.1.12 Source cves: CVE-2026-48710 Source advisory: OSV:GHSA-86QP-5C8J-P5MR...

biomni-bridge (>=0.3.1, <=0.3.3), github-pr-mcp-server (1.0.3) potentially affected by CVE-2026-10783 via gradio (5.39.0)

gradio PYPI version 5.39.0 is affected by a known vulnerability. The following packages have a transitive dependency on gradio and may be impacted: - biomni-bridge =0.3.1, =0.3.3 - github-pr-mcp-server 1.0.3 Source cves: CVE-2026-10783 Source advisory: OSV:PYSEC-2026-211...

Important: Red Hat Security Advisory: satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview

A new satellite/foreman-mcp-server-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Satellite provides a container image that you can use to run an MCP server locally. The MCP server for Satellite is designed for advanced reporting and data analysi...

avalan (>=1.2.0, <=1.2.13), mcp-instana (0.1.1) +4 more potentially affected by CVE-2026-5241 via transformers (4.53.1)

transformers PYPI version 4.53.1 is affected by a known vulnerability. The following packages have a transitive dependency on transformers and may be impacted: - avalan =1.2.0, =0.8.6, =0.9.2a0, =0.9.1a0, =0.9.2 Source cves: CVE-2026-5241 Source advisory: OSV:PYSEC-2026-2290...

auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2026-4035 via mlflow (2.20.3)

mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2026-4035 Source advisory: OSV:GHSA-G35P-PX32-WHV6...

auto-mlflow (1.5.0), databricks-genai (>=1.2.0a23, <=1.2.0a24) +2 more potentially affected by CVE-2026-4035 via mlflow (2.20.3)

mlflow PYPI version 2.20.3 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - auto-mlflow 1.5.0 - databricks-genai =1.2.0a23, =0.1.0, =0.99.9, =0.99.9.post1 Source cves: CVE-2026-4035 Source advisory: OSV:PYSEC-2026-2222...

Malicious code in brave-search-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d7d65e78a73a4cc2064d0ab9210a76c7c55f69553b70879dd649d7ad84e48dc0 The OpenSSF Package Analysis project identified 'brave-search-mcp-server' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

MAL-2026-5182 Malicious code in brave-search-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis d7d65e78a73a4cc2064d0ab9210a76c7c55f69553b70879dd649d7ad84e48dc0 The OpenSSF Package Analysis project identified 'brave-search-mcp-server' @ 1.0.0 npm as malicious. It is considered malicious because: - The...

Exploit for Missing Authentication for Critical Function in Mcpjam Inspector

CVE-2026-23744 — MCPJam Unauthenticated Remote Code Execution...

EUVD-2026-34057

A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function issaferegexpattern of the component searchcodeadvanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. It is possible to launch the attack...

GHSA-647R-72HF-4VMH Code Index MCP is vulnerable to Uncontrolled Resource Consumption

A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function issaferegexpattern of the component searchcodeadvanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. It is possible to launch the attack...

EUVD-2026-34056

A security flaw has been discovered in wonderwhy-er DesktopCommanderMCP up to 0.2.38. This impacts an unknown function of the file src/search-manager.ts of the component startsearch. Performing a manipulation of the argument SearchResult results in inefficient regular expression complexity. It is...

Code Index MCP is vulnerable to Uncontrolled Resource Consumption

A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function issaferegexpattern of the component searchcodeadvanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. It is possible to launch the attack...

EUVD-2026-34048

A vulnerability was determined in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. The impacted element is the function executeblendercode of the file /src/blendermcp/server.py. This manipulation of the argument code causes code injection. The attack is possible to be carried...

EUVD-2026-34036

A vulnerability has been found in ahujasid blender-mcp up to 7636d13bded82eca58eb93c3f4cd8708dfdfbe8b. Impacted is the function Open of the file src/blendermcp/server.py. The manipulation of the argument inputimageurl leads to injection. Remote exploitation of the attack is possible. The exploit...

CVE-2026-10692

A weakness has been identified in johnhuang316 code-index-mcp up to 2.14.0. Affected is the function issaferegexpattern of the component searchcodeadvanced. Executing a manipulation of the argument regex can lead to inefficient regular expression complexity. It is possible to launch the attack...