Security Bulletin: z Open Editor and RSE CLI uses sdk-1.30.0.tgz which is vulnerable to CVE-2026-104850

Summary Security Bulletin: z Open Editor and RSE CLI uses sdk-1.30.0.tgz which is vulnerable to CVE-2026-104850 Vulnerability Details CVEID:CVE-2026-104850 DESCRIPTION: MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. Starting in version 1.12.0 and...

ROOT-APP-PYPI-CVE-2026-104873 CVE-2026-104873 in langgraph-sdk - Patched by Root

Root has patched CVE-2026-104873 in the langgraph-sdk package for Root:PyPI. Multiple fixed versions available...

seclab-taskflow-agent

GitHub Security Lab Taskflow Agent The Security Lab Taskflow Agent is an MCP-enabled multi-Agent framework for declarative, YAML-driven agentic workflows. Built on top of the OpenAI Agents SDK, it uses Pydantic for grammar validation and Jinja2 for template rendering. Core Concepts The Taskflow...

GHSA-846F-F764-76MX vulnerabilities

Vulnerabilities for packages: dotnet-sdk, ilspycmd, dotnet-sdk-stage0, promitor, dotnet...

GHSA-2FMV-RV2C-59X7 vulnerabilities

Vulnerabilities for packages: dotnet-sdk, ilspycmd, dotnet-sdk-stage0, promitor, dotnet...

GHSA-7HQP-7C5M-4VQ6 vulnerabilities

Vulnerabilities for packages: dotnet-sdk, dotnet, dotnet-sdk-stage0, promitor...

GHSA-C399-9853-6JMJ vulnerabilities

Vulnerabilities for packages: dotnet-sdk, dotnet, dotnet-sdk-stage0, promitor...

GHSA-R955-8Q5J-3H83 vulnerabilities

Vulnerabilities for packages: dotnet-sdk, dotnet, dotnet-sdk-stage0, promitor...

CVE-2026-96959 vulnerabilities

Vulnerabilities for packages: dotnet-sdk, dotnet, dotnet-sdk-stage0, promitor...

CVE-2026-96960 vulnerabilities

Vulnerabilities for packages: dotnet-sdk, dotnet, dotnet-sdk-stage0, promitor...

CVE-2026-70162 vulnerabilities

Vulnerabilities for packages: dotnet-sdk, ilspycmd, dotnet-sdk-stage0, promitor, dotnet...

CVE-2026-96958 vulnerabilities

Vulnerabilities for packages: dotnet-sdk, dotnet, dotnet-sdk-stage0, promitor...

CVE-2026-84008 vulnerabilities

Vulnerabilities for packages: dotnet-sdk, ilspycmd, dotnet-sdk-stage0, promitor, dotnet...

CVE-2026-110248

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

CVE-2026-110248 Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

CVE-2026-110248

The Amazon SageMaker Python SDK contains a vulnerability in the git_utils[.]py component affecting versions V3 before 3.10.0 and V2 before 2.257.3 . The runclone_command() function fails to redact credentials from subprocess error output during a failed git clone operation. This allows an authent...

CVE-2026-110248 Insertion of sensitive information into log files in Amazon SageMaker Python SDK git_utils[.]py

Insertion of sensitive information into log files in the gitutils.py component in Amazon SageMaker Python SDK V3 before 3.10.0 and V2 before 2.257.3 might allow an authenticated remote user to obtain plaintext repository credentials from CloudWatch Logs when a git clone operation fails, because t...

CVE-2026-109527

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-108395

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

CVE-2026-109527 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...