PT-2026-43402

Lumiverse is a full-featured AI chat application. Prior to 0.9.7, the MCP server creation endpoint validates the command field against an allowlist of binary names but forwards the args array to the child process without any validation. Every binary on the allowlist accepts an inline-code executi...

Lumiverse 参数注入漏洞

Lumiverse is a full-featured AI chat application suite developed by Prolix OCs’ individual developers. Versions of Lumiverse prior to 0.9.7 contained a parameter injection vulnerability. This vulnerability stemmed from the MCP server creating endpoint validation commands without verifying the arg...

CVE-2026-9473

A vulnerability has been found in c-rick jimeng-mcp 1.10.0. Affected by this vulnerability is the function getFileContent/uploadCoverFile/generateImage/generateVideo of the file src/api.ts. The manipulation of the argument filePath leads to path traversal. The attack may be initiated remotely. Th...

CVE-2026-9467

A vulnerability was identified in debugmcp mcp-debugger up to 0.20.0. Impacted is the function handleGetSourceContext of the file src/server.ts. The manipulation leads to path traversal. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The...

CVE-2026-9473 c-rick jimeng-mcp api.ts generateVideo path traversal

A vulnerability has been found in c-rick jimeng-mcp 1.10.0. Affected by this vulnerability is the function getFileContent/uploadCoverFile/generateImage/generateVideo of the file src/api.ts. The manipulation of the argument filePath leads to path traversal. The attack may be initiated remotely. Th...

CVE-2026-9473

CVE-2026-9473 affects c-rick jimeng-mcp 1.10.0. The vulnerability lies in src/api.ts functions getFileContent, uploadCoverFile, generateImage, and generateVideo where manipulating the argument filePath enables path traversal. The attack could be remote; exploit has been disclosed publicly and the...

CVE-2026-9473

A vulnerability has been found in c-rick jimeng-mcp 1.10.0. Affected by this vulnerability is the function getFileContent/uploadCoverFile/generateImage/generateVideo of the file src/api.ts. The manipulation of the argument filePath leads to path traversal. The attack may be initiated remotely. Th...

EUVD-2026-31706

A vulnerability has been found in c-rick jimeng-mcp 1.10.0. Affected by this vulnerability is the function getFileContent/uploadCoverFile/generateImage/generateVideo of the file src/api.ts. The manipulation of the argument filePath leads to path traversal. The attack may be initiated remotely. Th...

CVE-2026-9473 c-rick jimeng-mcp api.ts generateVideo path traversal

A vulnerability has been found in c-rick jimeng-mcp 1.10.0. Affected by this vulnerability is the function getFileContent/uploadCoverFile/generateImage/generateVideo of the file src/api.ts. The manipulation of the argument filePath leads to path traversal. The attack may be initiated remotely. Th...

CVE-2026-9467 debugmcp mcp-debugger server.ts handleGetSourceContext path traversal

A vulnerability was identified in debugmcp mcp-debugger up to 0.20.0. Impacted is the function handleGetSourceContext of the file src/server.ts. The manipulation leads to path traversal. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The...

CVE-2026-9467

CVE-2026-9467 concerns the debugmcp mcp-debugger prior to 0.20.0, where the vulnerability lies in the function handleGetSourceContext within src/server.ts . The description indicates a path traversal vulnerability that can be triggered remotely, with a publicly available exploit referenced in sou...

EUVD-2026-31697

A vulnerability was identified in debugmcp mcp-debugger up to 0.20.0. Impacted is the function handleGetSourceContext of the file src/server.ts. The manipulation leads to path traversal. The attack is possible to be carried out remotely. The exploit is publicly available and might be used. The...

Malicious code in explorhub-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9788bd481519def1387f4eccde46e4e6fbb3d8acc8e6b181397f299581d9a174 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview explorhub-mcp-server is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-4312 Malicious code in explorhub-mcp-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9788bd481519def1387f4eccde46e4e6fbb3d8acc8e6b181397f299581d9a174 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview mcp-dashboards-shared is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in mcp-dashboards-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 720dd8595b499c7de37cf7521350fc060292eeea4742de4d8266a9cd7799152c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-4296 Malicious code in mcp-dashboards-shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 720dd8595b499c7de37cf7521350fc060292eeea4742de4d8266a9cd7799152c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

mcp-debugger 路径遍历漏洞

mcp-debugger is debugmcp open source a multi-language debugging tool . debugmcp mcp-debugger 0.20.0 and earlier versions of the path traversal vulnerability , the vulnerability stems from the operation of the parameters of the function handleGetSourceContext in the file src/server.ts , which may...

PT-2026-43088

A vulnerability has been found in c-rick jimeng-mcp 1.10.0. Affected by this vulnerability is the function getFileContent/uploadCoverFile/generateImage/generateVideo of the file src/api.ts. The manipulation of the argument filePath leads to path traversal. The attack may be initiated remotely. Th...