EUVD-2026-44798

MCP Python SDK: WebSocket server transport does not support Host/Origin validation...

Missing Origin Validation in WebSockets

Overview mcp is a Model Context Protocol SDK Affected versions of this package are vulnerable to Missing Origin Validation in WebSockets in the deprecated websocketserver transport function, which builds a Starlette WebSocket and calls acceptsubprotocol='mcp' without inspecting the connection's...

CVE-2023-49899 Origin Validation Error in X-Rite MA-T6

An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel...

CVE-2023-49899

Summary: CVE-2023-49899 affects X-Rite MAT 6 Kohinoor embedded spectrometer software. The root cause is insufficient origin validation/input validation in the communication channel, enabling a remote, unauthenticated attacker to execute commands on the device. Vulnerability details: Affected prod...

CVE-2023-49900 Origin Validation Error in X-Rite MA-T6

An unauthenticated remote attacker is able to perform remote code execution due to incorrectly sanitized user input in the SetParameter command...

CVE-2023-49900

CVE-2023-49900 affects X-Rite MAT 6 Kohinoor embedded spectrophotometer software. The issue is an origin validation error caused by incorrectly sanitized input in the SetParameter command, enabling an unauthenticated remote attacker to achieve remote code execution. The CVSS 3.1 vector is Network...

CVE-2026-59950

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. Prior to 1.28.1, the deprecated mcp.server.websocket.websocketserver transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restric...

CVE-2026-59950

The MCP Python SDK (package name mcp on PyPI) contains a vulnerability in the deprecated mcp.server.websocket.websocket_server transport prior to version 1.28.1, which accepted WebSocket handshakes without Host or Origin header validation. This prevents restrictions on originating connections to ...

CVE-2026-59950 MCP Python SDK: WebSocket server transport does not support Host/Origin validation

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. Prior to 1.28.1, the deprecated mcp.server.websocket.websocketserver transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restric...

CVE-2026-59950 MCP Python SDK: WebSocket server transport does not support Host/Origin validation

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. Prior to 1.28.1, the deprecated mcp.server.websocket.websocketserver transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restric...

CVE-2026-59950 MCP Python SDK: WebSocket server transport does not support Host/Origin validation

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. Prior to 1.28.1, the deprecated mcp.server.websocket.websocketserver transport accepted WebSocket handshakes without applying Host or Origin header validation, leaving no SDK-level way to restric...

CVE-2026-61451

The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...

EUVD-2026-44648

The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...

CVE-2026-61451 Grav before 1.0.4 Password Reset Token Poisoning via admin_base_url

The Grav API plugin grav-plugin-api before 1.0.4 does not validate the origin of the client-supplied adminbaseurl field in the POST /api/v1/auth/forgot-password endpoint. The sanitizeHttpUrl function only checks that the URL scheme is http/https and never verifies the host against the server's ow...

PT-2026-60301

Name of the Vulnerable Software and Affected Versions mcp versions prior to 1.28.1 Description The MCP Python SDK, a Python implementation of the Model Context Protocol, contains an issue in the deprecated mcp.server.websocket.websocket server transport. This component accepts WebSocket handshake...

PT-2026-60349

MSI Center NTIOLib X64 Origin Validation Error Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MSI Center. An attacker must first obtain the ability to execute low-privileged code on the target system in order...

CVE-2026-56181

Origin validation error in Windows Network Address Translation NAT allows an unauthorized attacker to perform spoofing over an adjacent network...

Windows Network Address Translation (NAT) Spoofing Vulnerability

Origin validation error in Windows Network Address Translation NAT allows an unauthorized attacker to perform spoofing over an adjacent network...

PT-2026-58599

Name of the Vulnerable Software and Affected Versions Windows Network Address Translation NAT affected versions not specified Description An origin validation error in Windows Network Address Translation NAT allows an unauthorized attacker to perform spoofing over an adjacent network, enabling th...

PYSEC-2026-2510 Hermes Agent contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation

Hermes Agent before 0.16.0 contains a DNS rebinding vulnerability in WebSocket endpoints that allows remote attackers to bypass Host and Origin validation. FastAPI HTTP middleware does not execute for WebSocket upgrade requests on /api/pty, /api/ws, /api/pub, and /api/events endpoints, enabling...