proxmark3

Iceman Fork - Proxmark3 The Proxmark3 is the swiss-army tool of RFID, allowing for interactions with the vast majority of RFID tags on a global scale. Originally built by Jonathan Westhues, the device is now the goto tool for RFID Analysis for the enthusiast. Iceman repository is considered to be...

CVE-2026-115498

The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g-website Website contact-field' parameter in all versions up to, and including, 2.7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

CVE-2026-115498

The Slim Jetpack plugin for WordPress (versions up to and including 2.7.0.1 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the g-website (Website contact-field) parameter due to insufficient input sanitization and output escaping. Because nonce and authentication checks...

CVE-2026-115498 Slim Jetpack <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting via Contact Form 'Website' Field

The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g-website Website contact-field' parameter in all versions up to, and including, 2.7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

EUVD-2026-116807

The Slim Jetpack plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'g-website Website contact-field' parameter in all versions up to, and including, 2.7.0.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...

WordPress Slim Jetpack plugin <= 2.7.0.1 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Yaniv Haliwa in WordPress Plugin Slim Jetpack versions = 2.7.0.1...

5mghost-rover (>=0.0.1, <=0.0.3), agent-tollgate (1.0.0) +86 more potentially affected by unknown CVE via fastmcp-slim (>=4.0.0, <=4.1.1)

fastmcp-slim PYPI version =4.0.0, =0.0.1, =0.1.2, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =1.3.3rc20, =1.1.2rc1, =1.1.0, =0.1.0, =0.1.0a1, =0.11.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-7XGJ-8392-5Q4R...

a2cr-mcp (0.1.8), accordance-port (>=0.2.0, <=1.0.0) +185 more potentially affected by unknown CVE via fastmcp-slim (>=3.3.0b1, <=3.4.9)

fastmcp-slim PYPI version =3.3.0b1, =0.2.0, =0.1.0, =0.2.124, =0.0.1, =0.0.1, =0.1.0, =2.3.2, =0.11.1, =2026.6.9, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: GHSA-7XGJ-8392-5Q4R...

5mghost-rover (>=0.0.1, <=0.0.3), agent-tollgate (1.0.0) +86 more potentially affected by unknown CVE via fastmcp-slim (>=4.0.0, <=4.1.1)

fastmcp-slim PYPI version =4.0.0, =0.0.1, =0.1.2, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =1.3.3rc20, =1.1.2rc1, =1.1.0, =0.1.0, =0.1.0a1, =0.11.2 and more Source cves: unknown CVE Source advisory: GHSA-7XGJ-8392-5Q4R...

GHSA-7XGJ-8392-5Q4R FastMCP: Post-transform component authorization is skipped on direct calls

Maintainer assessment and remediation This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the...

FastMCP: Post-transform component authorization is skipped on direct calls

Maintainer assessment and remediation This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the...

a2cr-mcp (0.1.8), accordance-port (>=0.2.0, <=1.0.0) +185 more potentially affected by unknown CVE via fastmcp-slim (>=3.3.0b1, <=3.4.9)

fastmcp-slim PYPI version =3.3.0b1, =0.2.0, =0.1.0, =0.2.124, =0.0.1, =0.0.1, =0.1.0, =2.3.2, =0.11.1, =2026.6.9, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:GHSA-7XGJ-8392-5Q4R...

Insufficiently Protected Credentials

Overview fastmcp-slim is a The dependency-slim FastMCP package. Affected versions of this package are vulnerable to Insufficiently Protected Credentials via ClientCredentialsOAuthProvider when no issuer is configured, because the client does not validate that the authorization server advertised b...

5mghost-rover (>=0.0.1, <=0.0.3), adeu (>=1.31.0, <=3.0.0) +121 more potentially affected by unknown CVE via fastmcp-slim (>=4.0.0a1, <=4.1.1)

fastmcp-slim PYPI version =4.0.0a1, =0.0.1, =1.31.0, =0.2.0, =0.1.2, =0.1.0, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =1.3.3rc20, =1.1.2rc1, =0.23.0, =0.23.3.dev8 and more Source cves: unknown CVE Source advisory: GHSA-VQQP-X5QM-5QP4...

5mghost-rover (>=0.0.1, <=0.0.3), adeu (>=1.31.0, <=3.0.0) +121 more potentially affected by unknown CVE via fastmcp-slim (>=4.0.0a1, <=4.1.1)

fastmcp-slim PYPI version =4.0.0a1, =0.0.1, =1.31.0, =0.2.0, =0.1.2, =0.1.0, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =1.3.3rc20, =1.1.2rc1, =0.23.0, =0.23.3.dev8 and more Source cves: unknown CVE Source advisory: SNYK:PYTHON-FASTMCPSLIM-21663380...

GHSA-VQQP-X5QM-5QP4 FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can...

5mghost-rover (>=0.0.1, <=0.0.3), adeu (>=1.31.0, <=3.0.0) +121 more potentially affected by unknown CVE via fastmcp-slim (>=4.0.0a1, <=4.1.1)

fastmcp-slim PYPI version =4.0.0a1, =0.0.1, =1.31.0, =0.2.0, =0.1.2, =0.1.0, =0.1.0, =0.0.2, =0.1.0, =0.1.0, =1.3.3rc20, =1.1.2rc1, =0.23.0, =0.23.3.dev8 and more Source cves: unknown CVE Source advisory: OSV:GHSA-VQQP-X5QM-5QP4...

FastMCP MCP client wrappers construct M2M OAuth providers without issuer binding — client secret redirectable to attacker-advertised authorization server

Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can...

PT-2026-135862

Maintainer assessment and remediation This report is accepted as a FastMCP credential-binding vulnerability. Affected versions of the OAuth client credentials providers do not expose the authorization-server issuer that owns pre-registered credentials. An untrusted or compromised MCP server can...

PT-2026-135855

Maintainer assessment and remediation This report is accepted as a FastMCP authorization vulnerability. In supported configurations, a server transform can change the metadata used by a component's authorization policy. Direct lookups previously checked the original component but returned the...