378 matches found
EUVD-2025-200280
arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints...
GHSA-G2JX-37X6-6438 arcade-mcp-server Has Default Hardcoded Worker Secret That Allows Full Unauthorized Access to All HTTP MCP Worker Endpoints
Summary The arcade-mcp HTTP server uses a hardcoded default worker secret "dev" that is never validated or overridden during normal server startup. As a result, any unauthenticated attacker who knows this default key can forge valid JWTs and fully bypass the FastAPI authentication layer. This...
CVE-2025-66454
creationtimestamp| type| source ---|---|--- 2025-12-02 00:58:19+00:00| published-proof-of-concept| https://github.com/ArcadeAI/arcade-mcp/security/advisories/GHSA-g2jx-37x6-6438...
Arcade MCP Server Framework 信任管理问题漏洞
Arcade MCP Server Framework is an open source MCP server framework from Arcade.dev. A trust management issue vulnerability exists in Arcade MCP Server Framework versions prior to 1.5.4, which stems from hard-coding the default working key, which could lead to bypassing the authentication layer...
PT-2025-48750
Name of the Vulnerable Software and Affected Versions Arcade MCP versions prior to 1.5.4 Description Arcade MCP’s HTTP server uses a hardcoded default worker secret dev that is not validated or overridden during server startup. This allows unauthenticated attackers who know the default key to for...
WordPress CTL Arcade Lite plugin cross-site request forgery vulnerability
WordPress CTL Arcade Lite plugin is a WordPress plugin for creating professional-grade arcade game websites with support for ad management, social sharing, leaderboards and more. The WordPress CTL Arcade Lite plugin suffers from a cross-site request forgery vulnerability, which originates from a...
CVE-2025-11886
The CTL Arcade Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'ctlarcadelitepagemanagegames' page. This makes it possible for unauthenticated attackers to deactivate and...
EUVD-2025-60963
The CTL Arcade Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'ctlarcadelitepagemanagegames' page. This makes it possible for unauthenticated attackers to deactivate and...
CVE-2025-11886
The CTL Arcade Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'ctlarcadelitepagemanagegames' page. This makes it possible for unauthenticated attackers to deactivate and...
CVE-2025-11886 CTL Arcade Lite <= 1.0 - Cross-Site Request Forgery to Plugin Activation and Deactivation
The CTL Arcade Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'ctlarcadelitepagemanagegames' page. This makes it possible for unauthenticated attackers to deactivate and...
CVE-2025-11886
The CTL Arcade Lite WordPress plugin is affected by CVE-2025-11886 due to a Cross-Site Request Forgery vulnerability. All versions up to 1.0 lack proper nonce validation on the ctl_arcade_lite_page_manage_games page, allowing unauthenticated attackers to deactivate or activate arbitrary plugins b...
CVE-2025-11886 CTL Arcade Lite <= 1.0 - Cross-Site Request Forgery to Plugin Activation and Deactivation
The CTL Arcade Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the 'ctlarcadelitepagemanagegames' page. This makes it possible for unauthenticated attackers to deactivate and...
WordPress plugin CTL Arcade Lite 跨站请求伪造漏洞
WordPress CTL Arcade Lite plugin is a WordPress plugin for creating professional-grade arcade game websites with support for ad management, social sharing, leaderboards and more. The WordPress CTL Arcade Lite plugin suffers from a cross-site request forgery vulnerability, which originates from a...
PT-2025-46263
Name of the Vulnerable Software and Affected Versions CTL Arcade Lite plugin for WordPress versions prior to 1.1 Description The software is susceptible to Cross-Site Request Forgery CSRF due to missing or incorrect nonce validation on the 'ctl arcade lite page manage games' page. This allows...
EUVD-2007-3547
Malware in sbrugna...
EUVD-2006-3103
Malware in sbrugna...
EUVD-2009-2285
Malware in sbrugna...
EUVD-2009-2761
Malware in sbrugna...