PT-2026-69254

Name of the Vulnerable Software and Affected Versions angrysky56 advanced-reasoning-mcp version 1.0.0 Description A path traversal issue exists in the file src/index.ts within the functions create system json, create library, get system json, and switch memory library. Path traversal is a flaw th...

CVE-2026-19372: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in Handwriting-OCR handwriting-ocr-mcp-server 0.1.0. Affected by this vulnerability is the function fs.readFileSync of the file src/index.ts of the component uploaddocument. Performing a manipulation of the argument File results in path traversal. Attacking...

CVE-2026-19365: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in Ichigo3766 image-gen-mcp 0.1.0. The impacted element is an unknown function of the file src/index.ts of the component upscaleimages. Such manipulation of the argument outputpath leads to path traversal. The attack must be carried out locally. The project was...

PT-2026-69303

Name of the Vulnerable Software and Affected Versions lmammino oidc-authorizer version 0.4.0 Description A flaw in the Authorization Header Parsing component allows remote attackers to cause a denial of service. The issue occurs within the parse token from header function located in the src/parse...

PT-2026-69307

Name of the Vulnerable Software and Affected Versions Ichigo3766 image-gen-mcp version 0.1.0 Description A path traversal issue exists within the upscale images component in the src/index.ts file. A local attacker can manipulate the output path argument to access or overwrite files outside the...

PT-2026-69248

Name of the Vulnerable Software and Affected Versions IncomeStreamSurfer roo-code-memory-bank-mcp-server versions up to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e Description A path traversal issue exists in the read memory bank file/append memory bank entry component within the src/index.ts file...

CVE-2026-19373: Server-Side Request Forgery (SSRF)

A weakness has been identified in PhialsBasement KoboldCPP-MCP-Server 1.0.0. Affected by this issue is the function makeRequest of the file src/index.ts of the component BaseConfigSchema. Executing a manipulation of the argument apiUrl can lead to server-side request forgery. It is possible to...

CVE-2026-19367: Server-Side Request Forgery (SSRF)

A vulnerability has been found in NocteDefensor LudusMCP 1.0.24. Affected by this vulnerability is an unknown functionality of the file src/tools/rangeConfig.ts of the component readrangeconfig. The manipulation of the argument Source leads to server-side request forgery. The attack may be...

PT-2026-69293

Name of the Vulnerable Software and Affected Versions mifi lossless-cut versions prior to 3.69.1 Description A server-side request forgery issue exists within the Built-in HTTP API Service component, specifically in the src/main/httpServer.ts file. This flaw allows an attacker with local network...

PT-2026-69252

Name of the Vulnerable Software and Affected Versions andreahaku codex mcp versions up to 1ff521cc6cc57cfe56ddef946c644b8534771390 Description Command injection is possible in the ask MCP Tool component within the file src/codex-process-simple.ts. The issue occurs when the model argument is...

PT-2026-69258

Name of the Vulnerable Software and Affected Versions NightTrek Ollama-mcp versions up to 80cf2e17cfc144963a475b619093a2d13c13dbc9 Description A flaw in the file src/index.ts allows for command injection through the manipulation of the name, modelfile, source, or destination arguments. This issue...

CVE-2026-19335: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc/utils/config.ts. Such manipulation of the argument skillName leads to path traversal. The attack can only be performed from a local...

CVE-2026-19336: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Performing a manipulation of the argument categoryName results in path traversal. The attack is only possible with local access...

CVE-2026-19352: Server-Side Request Forgery (SSRF)

A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the...

CVE-2026-19324: Improper Limitation of a Pathname to a Restricted Directory

A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restrict...

CVE-2026-19329: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in andreahaku codexmcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. The affected element is an unknown function of the file src/codex-process-simple.ts of the component ask MCP Tool. The manipulation of the argument model results in command injection. The attack...

CVE-2026-19334: Improper Neutralization of Special Elements used in a Command

A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This affects an unknown part of the file src/index.ts. This manipulation of the argument name/modelfile/source/destination causes command injection. The attack can only be executed locally. This product ...

PT-2026-69247

Name of the Vulnerable Software and Affected Versions HelloGGX shadcn-vue-mcp versions up to e170e277b94235cde627803277fc8c41103a4d38 Description A path traversal issue exists in the fs.promises.readFile function within the src/server/callback-server.ts file. This occurs when the filepath argumen...

CVE-2026-19371: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was identified in Nikolaibibo claude-comfyui-mcp 1.0.0. Affected is the function copyFileSync of the file src/tools/utils.ts of the component comfyuploadimage. Such manipulation of the argument imagepath leads to path traversal. An attack has to be approached locally. The project...

PT-2026-69311

Name of the Vulnerable Software and Affected Versions NocteDefensor LudusMCP version 1.0.24 Description A server-side request forgery exists in the read range config component within the src/tools/rangeConfig.ts file. A remote attacker can trigger this issue by manipulating the Source argument,...