CVE-2026-63118 MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a...

GHSA-3JH7-WM29-Q568 veraPDF Validation XXE via Rich Text

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious rich-text /RC or /RV entry. This affects all...

CVE-2026-54078 veraPDF Validation XXE via Rich Text

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in...

CVE-2026-54078

The VeraPDF validation project contains an XXE vulnerability in the validation-model module (DictionaryKeysHelper.getRichTextStringOrStreamEntryStringRepresentation). A crafted PDF with malicious rich-text /RC or /RV entries can trigger external entity expansion and reflect local file contents in...

veraPDF Validation XXE via XFA

Summary Description An XML External Entity Injection CWE-611 vulnerability in veraPDF allows a remote attacker to read arbitrary files on the server file system and perform Server-Side Request Forgery by submitting a crafted PDF containing a malicious XFA stream. This affects all current versions...

MINI-934X-CR8V-6M6J

Bulletin has no description...

MINI-PH48-785J-388J

Bulletin has no description...

MINI-Q3VP-RMX8-X93J

Bulletin has no description...

MINI-53HM-24MV-RWMG

Bulletin has no description...

MINI-WCFR-589R-XR2W

Bulletin has no description...

MINI-MF52-V926-3VPJ

Bulletin has no description...

CVE-2026-63230

A pre-authentication error-based SQL injection vulnerability in Koollab LMS allowed an unauthenticated attacker to read sensitive database contents, including personally identifiable information, credentials, and valid JWT tokens that may enable account takeover, via the SCORM report endpoint...

MINI-W35W-6RVW-P3XV

Bulletin has no description...

PT-2026-65821

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in...

PT-2026-65888

Name of the Vulnerable Software and Affected Versions mcp versions prior to 0.23.0 Description The MCP::Server::Transports::StreamableHTTPTransport component in the mcp gem fails to validate the HTTP Host or Origin request headers. This allows a malicious browser page to utilize DNS rebinding—a...

PT-2026-65899

Name of the Vulnerable Software and Affected Versions mcp versions prior to 0.23.0 Description The MCP::Server::Transports::StreamableHTTPTransport component in the mcp gem reads and parses an entire JSON-RPC POST body without enforcing a size limit. This allows an unauthenticated remote attacker...

CVE-2026-54078: Improper Restriction of XML External Entity Reference

veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity XXE vulnerability in validation-model/src/main/java/org/verapdf/gf/model/tools/DictionaryKeysHelper.java in...

PT-2026-65898

Name of the Vulnerable Software and Affected Versions mcp versions prior to 0.23.0 Description The MCP::Server::Transports::StreamableHTTPTransport component in the mcp gem fails to bind a session ID to a session owner. This allows an attacker who has obtained a stolen session ID to send tools/ca...

📄 rouille 3.6.2 HTTP Request Smuggling

rouille versions 3.6.2 and earlier contain an HTTP request smuggling vulnerability in the reverse proxy implementation. The proxy forwards the client's Transfer-Encoding header unchanged while forwarding a de-chunked request body, allowing backend request desynchronization and, under certain...

PT-2026-65897

Name of the Vulnerable Software and Affected Versions mcp versions prior to 0.23.0 Description The MCP::Server::Transports::StreamableHTTPTransport component in the mcp gem does not expire sessions by default. Consequently, repeated initialize requests lead to the retention of unbounded...