CVE-2026-76892

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated...

CVE-2026-63655

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer without a...

CVE-2026-76892 tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated...

CVE-2026-76892 tsParticles: Malformed JSON requests can terminate the @tsparticles/mcp-server HTTP process

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated...

CVE-2026-76892

The tsParticles TypeScript library (specifically the @tsparticles/mcp-server component) is vulnerable to a Denial of Service (DoS) condition in versions prior to 4.3.1 . The root cause is that the POST /mcp handler calls JSON.parse outside of a request-local error boundary in integrations/mcp-ser...

CVE-2026-63655 tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer without a...

CVE-2026-63655 tsParticles: Unbounded HTTP Request Body Buffering in @tsparticles/mcp-server Leads to Remote DoS

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer without a...

CVE-2026-63655

The tsParticles TypeScript library (specifically the @tsparticles/mcp-server component) is vulnerable to a Denial of Service (DoS) attack in versions prior to 4.3.1 . The vulnerability exists because the HTTP mode accepts unauthenticated POST /mcp requests and accumulates request-body chunks into...

PT-2026-137222

Name of the Vulnerable Software and Affected Versions tsParticles versions prior to 4.3.1 Description The HTTP mode of @tsparticles/mcp-server contains a flaw where JSON.parse is called outside a request-local error boundary within the POST '/mcp' endpoint. An unauthenticated user can send a...

CVE-2026-55786

Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards executemodule arguments to the module registry without the requireauth dependency used by the REST...

CVE-2026-55786

Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards executemodule arguments to the module registry without the requireauth dependency used by the REST...

EUVD-2026-101589

Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards executemodule arguments to the module registry without the requireauth dependency used by the REST...

CVE-2026-55786: Improper Neutralization of Special Elements used in an OS Command

Flyto2 Core is an execution kernel for automation and AI-agent workflows. From 2.26.2 until 2.26.4, the HTTP MCP POST /mcp route accepts unauthenticated JSON-RPC tools/call requests and forwards executemodule arguments to the module registry without the requireauth dependency used by the REST...

CVE-2026-45019

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For sse and streamable-http...

CVE-2026-45018

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...

CVE-2026-45018: Improper Neutralization of Special Elements used in an OS Command

Chainlit is a Python framework for building production-ready conversational AI applications. From 2.4.0rc0 until 2.12.0, Chainlit deployments with features.mcp.enabled set to true in .chainlit/config.toml expose the POST /mcp endpoint without requiring authentication. For stdio transport, the...

SiYuan CVE-2026-66012 MCP Auth Bypass Detect

Detects CVE-2026-66012 in SiYuan kernel 3.7.0 = v 3.7.2: POST /mcp on the Publish port default 6808 accepts anonymous RoleReader JWTs when Publish auth is disabled, exposing MCP tools including workspace file read without credentials. !/usr/bin/env python3 -- coding: utf-8 -- """Detect SiYuan...

SiYuan: Auth Bypass

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

CVE-2026-66012

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...

CVE-2026-66012: Missing Authorization

SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check model.CheckAuth with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool with list/read/write/delete/rename/copy...