EUVD-2026-111366

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing...

CVE-2026-116686

The Model Context Protocol Python SDK contains a vulnerability in versions 1.10.0 through 1.30.0 and 2.2.0 . The ClientSession, ClientSessionGroup, and Client tool calls use the default resolver in jsonschema to validate server-declared outputSchema documents. This allows a server to provide an u...

CVE-2026-116686

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing...

CVE-2026-116686 Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with jsonschema's default resolver, causing...

CVE-2026-116685

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamablehttpclient, streamablehttpclient, sseclient, ClientSessionGroup, OAuth, and createmcphttpclient client paths enable followredirects and...

CVE-2026-116685

The Model Context Protocol Python SDK is vulnerable in versions 1.8.0 up to 1.30.0 and 2.2.0 due to how its HTTP client transports handle redirects. Specifically, the streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and create_mcp_http_client paths may follow ...

EUVD-2026-111367

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamablehttpclient, streamablehttpclient, sseclient, ClientSessionGroup, OAuth, and createmcphttpclient client paths enable followredirects and...

CVE-2026-116685 Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamablehttpclient, streamablehttpclient, sseclient, ClientSessionGroup, OAuth, and createmcphttpclient client paths enable followredirects and...

CVE-2026-116685 Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.8.0 until 1.30.0 and 2.2.0, streamablehttpclient, streamablehttpclient, sseclient, ClientSessionGroup, OAuth, and createmcphttpclient client paths enable followredirects and...

RCE-Cacti-1.2.22

RCE-Cacti-1.2.22 This is exploit code for CVE-2022-46169, which I recreated using Python3! If you are working on an HTB machine, this might be useful... 🤞✨...

CVE-2026-116684 Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with tokenverifier accepts a valid token issued for another service when the...

EUVD-2026-111369

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with tokenverifier accepts a valid token issued for another service when the...

CVE-2026-116684

The Model Context Protocol Python SDK versions 1.10.0 through 1.30.0 and 2.2.0 are vulnerable to a resource-confusion flaw in the server-side bearer authentication. When configured via AuthSettings with token_verifier, the TokenVerifier fails to independently validate the aud audience , causing t...

CVE-2026-116684 Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with tokenverifier accepts a valid token issued for another service when the...

CVE-2026-116684

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with tokenverifier accepts a valid token issued for another service when the...

CVE-2019-5029

CVE-2019-5029 This is a Python script PoC for CVE-2019-5029. It is a RCE for Exhibitor Web UI 1.7.1. How to use Clone this repo git clone https://github.com/yZ1337/CVE-2019-5029.git Execute as follows python3 CVE-2019-5029.py Make sure the request inside the script is the same as the request of t...

CVE-2012-2982_Python

CVE-2012-2982Python PoC Python script as an exercice from tryhackme: https://tryhackme.com/room/intropocscripting This is the metasploit CVE: https://www.exploit-db.com/exploits/21851 Those are the changes done after the discovery of the Exploit:...

CVE-2019-9053-Fixed

The user assumes all responsibility for any action taken using this tool. If these terms are not acceptable to you, please do not use this tool. Use it only in environments where you are permitted to perform pentesting activities Bug fixes for the CVE-2019-9053 exploit Some bug fixes for the...

Zerodapi

Zerodai Documentation Start! pip install zerodai==0.0.0.20 export zerodapikey="YOURAPIKEY" Get your api key https://zerodai.com Simple Conversational Chat - No memory from zerodai import zerodai import os zerodai.apiauthos.getenv"zerodapikey" messages = while True: prompt = input" " if prompt ==...

log4j-urlscanner

log4j-detect Simple Python 3 script to detect the "Log4j" Java library vulnerability CVE-2021-44228 for a list of URL with multithreading The script "log4j-detect.py" developed in Python 3 is responsible for detecting whether a list of URLs are vulnerable to CVE-2021-44228. To do so, it sends a G...