298723 matches found
EUVD-2026-49941
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...
CVE-2026-16498 terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fix...
EUVD-2026-49940
The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability,...
CVE-2026-16496
The CVE concerns terraform-mcp-server prior to version 1.1.0, where an authorization bypass in the streamable-HTTP stateful transport mode could allow a user who obtains another user’s MCP session ID to execute tool calls using that user’s Terraform credentials. Affected component: terraform-mcp-...
CVE-2026-16496 terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user
The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability,...
CVE-2026-16496 terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user
The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability,...
CVE-2026-14869 terraform-mcp-server vulnerable to server side request forgery leading to token exposure
The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled...
EUVD-2026-49934
The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled...
CVE-2026-14869 terraform-mcp-server vulnerable to server side request forgery leading to token exposure
The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled...
CVE-2026-14869
The CVE-2026-14869 entry documents a vulnerability in terraform-mcp-server (pre-1.1.0) where a flaw in the streamable-HTTP transport allows an unauthenticated remote attacker to trigger server-side requests that can redirect the Terraform API calls and the server-side authorization token to an at...
CVE-2026-59931
CVE-2026-59931 (PhpSpreadsheet SSRF via WEBSERVICE domain whitelist bypass) Concrete technical details are present in connected sources: PhpSpreadsheet’s Calculation/Web/Service.php validates the host against a domain whitelist but uses file_get_contents() with a PHP HTTP stream wrapper that foll...
CVE-2026-59931 PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 through 3.10.6, 2.2.0 through 2.4.6, 2.0.0 through 2.1.17, and all releases up to and including 1.30.5, the WEBSERVICE domain whitelist can be bypassed via an HTTP redirect SSRF...
CVE-2026-67185
TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse without normalization, dot-segment...
CVE-2026-64382
A flaw was found in the Linux kernel's Server Message Block SMB client. A double-free vulnerability exists in the SMB2open replay mechanism. This occurs when a response-bearing attempt returns a replayable error and frees its response buffer, and then the cleanup process attempts to free the same...
CVE-2026-67185
TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse without normalization, dot-segment...
EUVD-2026-49904
TinyWeb through 0.0.8 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by submitting ../ sequences in the URL path, which are concatenated directly to the configured web root in HttpBuilder::buildResponse without normalization, dot-segment...
CVE-2026-67184
TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...
EUVD-2026-49902
TinyWeb through 0.0.8 contains a null pointer dereference vulnerability that allows unauthenticated remote attackers to crash worker processes by sending a malformed HTTP request line with an invalid version string. The HttpParser::execute function fails to allocate the Url object when version...
CVE-2026-66754
Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::removeprefix function that allows remote unauthenticated attackers to crash the server by sending a crafted percent-encoded URL. Attackers can send a request whose decoded path matches a configured prefix whi...
CVE-2026-66749
Let's Chat 0.4.0 through 0.4.8 contains a null dereference vulnerability that allows authenticated attackers to crash the server by supplying a valid 24-character hex string room parameter that matches no document in the database. Attackers can send a crafted GET /messages request causing an...