PT-2026-69280

Name of the Vulnerable Software and Affected Versions aliyun alibabacloud-dataworks-mcp-server versions prior to 1.0.44 Description A security flaw allows remote attackers to perform server-side request forgery SSRF, a technique where an attacker induces a server to make requests to an unintended...

CVE-2026-19339: Server-Side Request Forgery (SSRF)

A security flaw has been discovered in aliyun alibabacloud-dataworks-mcp-server up to 1.0.43. The impacted element is the function ReadResourceRequestSchema of the file src/resources/initResources.ts. The manipulation of the argument request.params.uri results in server-side request forgery. The...

CVE-2026-9680 MCP Server Exposure via Insecure Default Binding on alibabacloud-rds-openapi-mcp-server

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default...

CVE-2026-9680

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default...

CVE-2026-9680: Initialization of a Resource with an Insecure Default

Improper exposure of the MCP server in alibabacloud-rds-openapi-mcp-server allows remote attackers to invoke exposed MCP tools via network access to an MCP endpoint listening on all network interfaces by default...

Malicious code in alibabacloud-code-tool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5e4d81a71d0710ac3618ec41e8027ee6a96ae9845ca67b33b950c8d99d8d2e8a This package impersonates Alibaba Cloud account and contains highly obfuscated code. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

MAL-2026-915 Malicious code in alibabacloud-code-tool (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5e4d81a71d0710ac3618ec41e8027ee6a96ae9845ca67b33b950c8d99d8d2e8a This package impersonates Alibaba Cloud account and contains highly obfuscated code. --- Category: MALICIOUS - The campaign has clearly malicious intent, like...

@iflow-mcp/alibabacloud-dataworks-mcp-server (1.0.43), @mseep/alibabacloud-dataworks-mcp-server (1.0.36) +1 more potentially affected by CVE-2025-53110 via @modelcontextprotocol/server-filesystem (2025.3.28)

@modelcontextprotocol/server-filesystem NPM version 2025.3.28 is affected by a known vulnerability. The following packages have a transitive dependency on @modelcontextprotocol/server-filesystem and may be impacted: - @iflow-mcp/alibabacloud-dataworks-mcp-server 1.0.43 -...

Malicious code in alibabacloud-gateway-fc-util-py2 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2025-2934 Malicious code in alibabacloud-gateway-fc-util-py2 (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2023-8362 Malicious code in python-alibabacloud-sdk-core (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 1384f0a4ed6515eb7e720621346f74f53217b73863f4c5e3cda4fc90b52f49e3 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

Malicious code in alibabacloud-oss2 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security d804868504b96ba968b7eae99df63e235a0eaa2eab4a7951ae02c98c614f1828 Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

Malicious code in python-alibabacloud-tea-openapi (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: google-open-source-security 1a75cd94261db49f7ab1e359b2579e7645756a48f20eb6a49465f980f5c2b43d Attack targeted at users of Alibaba, AWS and Telegram via malicious packages published to PyPI. The malicious code was hidden in strategic...

PT-2021-22252

Name of the Vulnerable Software and Affected Versions netless Agora Flat Server versions prior to 2021-07-30 Description The issue concerns the remove API in the netless Agora Flat Server, specifically in the file v1/controller/cloudStorage/alibabaCloud/remove/index.ts, which mishandles file...

CVE-2021-38621: Undefined Security Weakness

The remove API in v1/controller/cloudStorage/alibabaCloud/remove/index.ts in netless Agora Flat Server before 2021-07-30 mishandles file ownership...