CVE-2026-102878

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

CVE-2026-102878

The mcp-chrome-bridge software, in versions through 1.0.31 , contains an origin validation error within its native-server HTTP API. This vulnerability allows an attacker to bypass CORS restrictions by crafting malicious web pages. Successful exploitation enables the execution of browser automatio...

CVE-2026-102878 mcp-chrome-bridge through 1.0.31 CORS Origin Bypass

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

CVE-2026-102878 mcp-chrome-bridge through 1.0.31 CORS Origin Bypass

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

EUVD-2026-89413

mcp-chrome-bridge through 1.0.31 contains an origin validation error in the native-server HTTP API that allows attackers to bypass CORS restrictions. Attackers can craft malicious web pages that make cross-origin requests to the local server and invoke browser automation tools including script...

CVE-2026-97615

A flaw was found in the Linux kernel's network bridge subsystem, which can lead to a Denial of Service DoS due to list corruption. When Connectivity Fault Management CFM or Media Redundancy Protocol MRP handlers are enabled across multiple network bridges, a shared data structure is improperly...

CVE-2026-97436

A flaw was found in the Linux kernel's dpaa2-switch driver. When multiple network bridges are configured across ports on the same switch device, removing a port from a bridge fails to release its Forwarding Database FDB, which tracks network destination addresses. A privileged user modifying...

kernel: net: bridge: stop fast-leave after deleting a port group

A flaw was found in the Linux kernel's network bridge module. When handling multicast fast-leave, a vulnerability exists where the system may attempt to access a port group after it has been deleted. This can occur if multicast-to-unicast was previously enabled and then disabled, leading to a sta...

CVE-2026-34197

CVE-2026-34197 - Apache ActiveMQ Jolokia 원격 코드 실행 RCE CVE-2026-34197은 Apache ActiveMQ Classic에 영향을 미치는 높은 심각도의 원격 코드 실행 RCE 취약점입니다. 이 문제는 /api/jolokia/ 엔드포인트를 통해 HTTP로 관리 작업을 노출하는 Jolokia JMX-HTTP 브리지에 존재합니다. 기본 Jolokia 액세스 정책은 인증된 사용자가 ActiveMQ MBeans에서 관리 작업을 호출할 수 있도록 허용합니다. 특정 브로커 관리 메서드는 사용자...

ROS-20260929-73-0044

The vulnerability of the ebtsnattg function in the net/bridge/netfilter/ebtsnat.c module, which implements networking functions in the Linux kernel, is related to the issue of data being written outside of the buffer. Exploiting this vulnerability could allow an attacker to compromise the...

SUSE CVE-2026-97615

In the Linux kernel, the following vulnerability has been resolved: net: bridge: use option bits for CFM/MRP frame handlers CFM and MRP register a global brframetype whose hlistnode is linked into the per-bridge frametypelist when the first MEP/MRP instance is created. Enabling the protocol on...

CVE-2026-98026

A flaw was found in the Linux kernel's network bridge subsystem. An attacker could exploit this vulnerability to cause a Denial of Service DoS or system crash through a use-after-free condition. This issue occurs during multicast port group removal, where the kernel immediately frees data...

CVE-2026-43499-T807D

T807D 最終成果物—ソースコード一対一対応復元パッケージ 生成日：2026-08-08 結論 本ディレクトリには、現在のプロジェクトで復元可能な完全な popsicle ソースツリー、必要なヘッダーファイル、埋め込み su ペイロード、本番バイナリ、および実行スクリプトが整理されています。 区別する必要があります： 1. r562 SO と r557 helper の本番バイナリは完全に保持されており、ハッシュは検証可能です。 2. プロジェクトには、これら2つの本番バイナリのコンパイル前の旧ソーススナップショット、オブジェクトファイル、または DWARF...

CVE-2026-34197

CVE-2026-34197 설명 Apache ActiveMQ Broker, Apache ActiveMQ에서 부적절한 입력 검증, 코드 생성 제어 부적절‘코드 인젝션’ 취약점입니다. Apache ActiveMQ Classic은 웹 콘솔의 /api/jolokia/에서 Jolokia JMX-HTTP 브리지를 노출합니다. 기본 Jolokia 액세스 정책은 BrokerService.addNetworkConnectorString 및 BrokerService.addConnectorString를 포함한 모든 ActiveMQ...

ida-pro-mcp

IDA Pro MCP ⚠️ Archived — superseded by the official Hex-Rays IDA MCP server This project is no longer maintained. On 2026-09-27 Hex-Rays SA released the Official IDA MCP Server and IDA Nexus. Development stopped the same day at 1.0.0a4. For current use, install theirs: uvx ida-hcli mcp install. I...

PayloadAutomation

Payload Automation이란 무엇인가? ================= 이제 PyPi 패키지로 사용할 수 있습니다: https://pypi.org/project/payload-automation/ Payload Automation은 Sleep과 Python 사이의 브리지 역할을 하는 Python 클래스 모음으로, Cobalt Strike 또는 여러분이 떠올릴 수 있는 다른 무엇과 함께 페이로드 개발, 테스트, OPSEC 점검 및 배포를 자동화하는 데 사용할 수 있습니다. 제공되는 기능을 활용하는 사전 제작된 스크립트는...

CVE-2026-100868

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...

CVE-2026-100868

Versions of Penpot prior to 2.18.0 are vulnerable to unauthenticated access via the MCP server plugin WebSocket bridge . In single-user mode, the bridge binds to all network interfaces without authentication, allowing unauthenticated attackers on adjacent networks to connect to the WebSocket port...

EUVD-2026-87940

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...

CVE-2026-100868 Penpot before 2.18.0 Unauthenticated WebSocket Access via MCP Bridge

Penpot before 2.18.0 binds the MCP server plugin WebSocket bridge to all network interfaces without authentication in single-user mode. Unauthenticated attackers on adjacent networks can connect to the WebSocket port to impersonate the Penpot browser plugin, intercept task payloads, and return...