OllamaHound

OllamaHound 노출된 Ollama 서버를 발견하고, 버전을 식별하며, 모델 접근을 검증하기 위한 모듈식 툴킷입니다. OllamaHound 는 공개적으로 노출된 Ollama 서버 를 발견하고, 버전을 식별하며, CVE 노출 여부를 분류 하고, 텍스트 생성이 가능한지 검증하며, 선택적으로 통제된 테스트를 위한 대화형 CLI 세션을 활성화하는 모듈식 RedTeam 지향 툴킷입니다. @@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@...

CloudFlair

CloudFlair 중요 사항: 2024년 후반부터 Censys는 무료 계정에 더 이상 API 액세스를 제공하지 않습니다. 이는 CloudFlair가 더 이상 무료 Censys 계정에서 작동하지 않음을 의미합니다. CloudFlair는 CloudFlare또는 CloudFront로 보호되는 웹사이트의 오리진 서버 중 공개적으로 노출되어 있으며 해당 CDN IP 범위에 대한 네트워크 액세스를 적절히 제한하지 않는 서버를 찾는 도구입니다. 이 도구는 Censys의 인터넷 전체 스캔 데이터를 사용하여 대상 도메인 이름과 연결된 SSL...

Cloudmare

Cloudmare Cloudmare는 DNS 설정이 잘못된 Cloudflare, Sucuri 또는 Incapsula로 보호되는 웹사이트의 원본 서버를 찾는 간단한 도구입니다. 이 일반적인 설정 오류와 Cloudmare의 작동 방식에 대한 자세한 내용은 비공개 메시지를 보내주세요. 실제 Cloudmare의 모습은 다음과 같습니다. 이 예시의 웹사이트와 IP 주소는 난독화되었습니다 설정 1. 저장소를 클론합니다 git clone https://github.com/MrH0wl/Cloudmare.git 2. 폴더로 이동합니다 cd...

GO-2026-6002 ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) in github.com/stacklok/toolhive

ToolHive: SSRF in remote MCP server authentication discovery host-side, bypasses container isolation in github.com/stacklok/toolhive...

GHSA-PR64-JMMF-JP54 ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation)

Security Advisory: SSRF in remote MCP server authentication discovery Severity: High. CWE: CWE-918. Affected: ToolHive through the latest release v0.29.3 and current main HEAD b672d82f, 2026-06-12; re-verified 2026-06-14. FetchResourceMetadata and the discovery clients remain unguarded; no commit...

PT-2026-60392

Name of the Vulnerable Software and Affected Versions ToolHive versions 0.x through 0.29.3 Description ToolHive contains a Server-Side Request Forgery SSRF issue during remote MCP server authentication discovery. The application issues outbound HTTP requests to URLs controlled by a remote MCP...

ALSA-2026:7342 Important: kea security update

DHCP implementation from Internet Systems Consortium, Inc. that features fully functional DHCPv4, DHCPv6 and Dynamic DNS servers. Both DHCP servers fully support server discovery, address assignment, renewal, rebinding and release. The DHCPv6 server supports prefix delegation. Both servers suppor...

MCP Servers Are the New Shadow IT for AI

Key Takeaways MCP servers are becoming the default wiring between AI agents and enterprise applications — but most organizations have zero visibility into where they are, what they expose, or how they can be abused. Qualys TotalAI now provides layered discovery of MCP servers across network, host...

Glances Central Browser Autodiscovery Leaks Reusable Credentials to Zeroconf-Spoofed Servers

Summary In Central Browser mode, Glances stores both the Zeroconf-advertised server name and the discovered IP address for dynamic servers, but later builds connection URIs from the untrusted advertised name instead of the discovered IP. When a dynamic server reports itself as protected, Glances...

CVE-2025-14204

A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command...

EUVD-2025-201615

A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command...

CVE-2025-14204

A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command...

CVE-2025-14204 TykoDev cherry-studio-TykoFork OAuth Server Discovery oauth-authorization-server redirectToAuthorization os command injection

A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command...

CVE-2025-14204

Summary of CVE-2025-14204 : TykoDev cherry-studio-TykoFork 0.1 is affected by an OS command injection in the OAuth Server Discovery flow. The vulnerability resides in the function redirectToAuthorization of the file /.well-known/oauth-authorization-server, where improper handling of the authoriza...

CVE-2025-14204 TykoDev cherry-studio-TykoFork OAuth Server Discovery oauth-authorization-server redirectToAuthorization os command injection

A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command...

CVE-2025-14204: Improper Neutralization of Special Elements used in an OS Command

A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command...

PT-2025-49418

A vulnerability has been found in TykoDev cherry-studio-TykoFork 0.1. This issue affects the function redirectToAuthorization of the file /.well-known/oauth-authorization-server of the component OAuth Server Discovery. Such manipulation of the argument authorizationUrl leads to os command...

@sequa-ai/sequa-mcp has Command Injection vulnerability

A vulnerability was detected in sequa-ai sequa-mcp up to 1.0.13. This affects the function redirectToAuthorization of the file src/helpers/node-oauth-client-provider.ts of the component OAuth Server Discovery. Performing manipulation results in os command injection. Remote exploitation of the...

CVE-2025-10619

A vulnerability was detected in sequa-ai sequa-mcp up to 1.0.13. This affects the function redirectToAuthorization of the file src/helpers/node-oauth-client-provider.ts of the component OAuth Server Discovery. Performing manipulation results in os command injection. Remote exploitation of the...

CVE-2025-10619 sequa-ai sequa-mcp OAuth Server Discovery node-oauth-client-provider.ts redirectToAuthorization os command injection

A vulnerability was detected in sequa-ai sequa-mcp up to 1.0.13. This affects the function redirectToAuthorization of the file src/helpers/node-oauth-client-provider.ts of the component OAuth Server Discovery. Performing manipulation results in os command injection. Remote exploitation of the...