SUSE CVE-2026-64430

In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid calling pciirqvector from hardirq context ntbepfvecisr calls pciirqvector in hardirq context to derive the vector number. pciirqvector calls msigetvirq that takes a mutex and can therefore trigger "scheduling whil...

GHSA-WVR4-3WQ4-GPC5 MCP Connect has unauthenticated remote OS command execution via /bridge endpoint

Summary When AUTHTOKEN and ACCESSTOKEN environment variables are not set which is the default out-of-the-box configuration the /bridge HTTP endpoint is completely unauthenticated. Any network-accessible caller can POST a request with an attacker-controlled serverPath and args payload, causing the...

MCP Connect has unauthenticated remote OS command execution via /bridge endpoint

Summary When AUTHTOKEN and ACCESSTOKEN environment variables are not set which is the default out-of-the-box configuration the /bridge HTTP endpoint is completely unauthenticated. Any network-accessible caller can POST a request with an attacker-controlled serverPath and args payload, causing the...