Anthropic / Microsoft MCP Server-Side Request Forgery

Both Anthropic mcp-server-fetch and Microsoft playwright-mcp suffer from server-side request forgery vulnerabilities by accepting arbitrary URLs passed by the AI agent/client without any allowlist enforcement, IP range blocking, or internal network filtering...

MAL-2026-4445 Malicious code in @signetai/signet-memory-openclaw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c0ad0b94bf8d4fa9787ee3ae220aa20bc7dde35d2f7a90d2a8e19a8781b8a552 On plugin registration in 'full' mode the package reads the installer's Claude Code OAuth credential from /.claude/.credentials.json and...