124536 matches found
MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
GHSA-VWXW-JRG6-9JXV MCP Toolbox HTTP tool path parameters allow traversal to unintended endpoints
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
CVE-2026-54231
creationtimestamp| type| source ---|---|--- 2026-06-29 18:16:58+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph3vg2wcb2d...
CVE-2026-57955
SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...
CVE-2026-56285
Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including...
CVE-2026-11720
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
CVE-2026-13590
creationtimestamp| type| source ---|---|--- 2026-06-29 17:51:54+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph2ilx2mu2d 2026-06-29 19:56:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mphbh5w62h2x 2026-06-29 20:42:39+00:00| seen|...
CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
CVE-2026-11720
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
EUVD-2026-40146
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
CVE-2026-11720
The CVE-2026-11720 entry describes a path traversal flaw in the HTTP tool URL builder of googleapis/mcp-toolbox. User-controlled pathParams are substituted into a configured tool path and then parsed as a relative URL; while scheme/host/user info are checked, final resolution uses ResolveReferenc...
CVE-2026-20189
creationtimestamp| type| source ---|---|--- 2026-06-29 17:31:52+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgzeqel3e2w...
EUVD-2026-40140
SigNoz through 0.130.1 contains a SQL injection vulnerability that allows authenticated attackers to execute arbitrary ClickHouse queries by injecting URL-encoded quotes into the rule ID path parameter of the alert-history endpoints. Attackers can manipulate the unsanitized rule ID interpolated...
CVE-2026-56285
Nitter's /video media proxy endpoint fails to validate target URLs against Twitter/X domains and uses a hardcoded default HMAC key, allowing unauthenticated attackers to compute valid HMACs for arbitrary URLs. Attackers can retrieve HTTP responses from any host reachable by the server, including...
CVE-2026-13750
creationtimestamp| type| source ---|---|--- 2026-06-29 17:09:53+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgy5hy76j23 2026-06-29 17:54:13+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mph2mpvmvb2b 2026-06-29 20:30:47+00:00| seen|...
CVE-2026-57334
creationtimestamp| type| source ---|---|--- 2026-06-29 16:57:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgxhwfjod25 2026-06-29 20:40:40+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphdweu6zk2k 2026-07-31 16:44:08+00:00| seen|...
CVE-2026-13581
creationtimestamp| type| source ---|---|--- 2026-06-29 16:49:51+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpgwzn4izb2n...
CVE-2026-57335
creationtimestamp| type| source ---|---|--- 2026-06-29 16:14:16+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpguzz4v2k2e 2026-06-29 20:41:25+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mphdxpoe662d...