PYSEC-2026-2599 LiteLLM: Authenticated command execution via MCP stdio test endpoints

Impact Two endpoints used to preview an MCP server before saving it — POST /mcp-rest/test/connection and POST /mcp-rest/test/tools/list — accepted a full server configuration in the request body, including the command, args, and env fields used by the stdio transport. When called with a stdio...

Metabase 0.43.x < 0.43.7.3 / 0.44.x < 0.44.7.3 /0.45.x < 0.45.4.3 / 0.46.x < 0.46.6.4 / 1.43.x < 1.43.7.3 / 1.44.x < 1.44.7.3 / 1.45.x < 1.45.4.3 / 1.46.x < 1.46.6.4

The version of Metabase installed on the remote host is affected by a remote code execution vulnerability. The core issue is that one of the supported data warehouses an embedded in-memory database H2, exposes a number of ways for a connection string to include code that is then executed by the...

PT-2024-32462 · Jsonpath +1 · Jsonpath +1

Name of the Vulnerable Software and Affected Versions: Shields.io versions prior to server-2024-09-25 Description: The issue concerns a remote execution vulnerability via the JSONPath library used by the Dynamic JSON/Toml/Yaml badges. This vulnerability allows any user with access to make a reque...

PYSEC-2021-424

Matrix is an ecosystem for open federated Instant Messaging and Voice over IP. In versions 1.41.0 and prior, unauthorised users can access the name, avatar, topic and number of members of a room if they know the ID of the room. This vulnerability is limited to homeservers where the vulnerable...