PT-2026-99572

Name of the Vulnerable Software and Affected Versions python-utcp versions prior to 1.1.4 Description An issue exists in the call tool function of the HttpCommunicationProtocol where the initial tool URL is validated, but subsequent HTTP redirects are followed without re-validating the target. Th...

PT-2026-96924

Name of the Vulnerable Software and Affected Versions MCP Atlassian versions prior to 0.22.0 Description An authorization bypass exists where the ENABLED TOOLS and TOOLSETS filters are only enforced during the tools/list request and are not re-verified when a tools/call request is dispatched. Thi...

Incorrect Authorization

Overview mcp-server-kubernetes is a MCP server for interacting with Kubernetes clusters via kubectl Affected versions of this package are vulnerable to Incorrect Authorization through the CallTool handler in src/index.ts. An attacker can invoke disallowed Kubernetes tools and perform destructive...

Server-side Request Forgery (SSRF)

Overview utcp-http is an UTCP communication protocol plugin for HTTP, SSE, and streamable HTTP, plus an OpenAPI converter. Affected versions of this package are vulnerable to Server-side Request Forgery SSRF via the calltool and calltoolstreaming functions when attacker-controlled URLs from OpenA...

CVE-2026-7627 8nite metatrader-4-mcp sync_ea_from_file index.ts CallToolRequestSchema path traversal

A security vulnerability has been detected in 8nite metatrader-4-mcp 1.0.0. This vulnerability affects the function CallToolRequestSchema of the file src/index.ts of the component synceafromfile. Such manipulation of the argument eaname leads to path traversal. The attack can be launched remotely...

PT-2026-36605

A security vulnerability has been detected in 8nite metatrader-4-mcp 1.0.0. This vulnerability affects the function CallToolRequestSchema of the file src/index.ts of the component sync ea from file. Such manipulation of the argument ea name leads to path traversal. The attack can be launched...

CVE-2026-5607

A security vulnerability has been detected in imprvhub mcp-browser-agent up to 0.8.0. This impacts the function CallToolRequestSchema of the file src/handlers.ts of the component URL Parameter Handler. The manipulation of the argument request.params.name/request.params.arguments leads to...

CVE-2026-5607 imprvhub mcp-browser-agent URL Parameter handlers.ts CallToolRequestSchema server-side request forgery

A security vulnerability has been detected in imprvhub mcp-browser-agent up to 0.8.0. This impacts the function CallToolRequestSchema of the file src/handlers.ts of the component URL Parameter Handler. The manipulation of the argument request.params.name/request.params.arguments leads to...

CVE-2026-5607

CVE-2026-5607 affects imprvhub mcp-browser-agent up to 0.8.0. The vulnerability resides in URL Parameter Handler’s CallToolRequestSchema within src/handlers.ts where manipulating request.params.name/request.params.arguments enables server-side request forgery. Public exploit disclosure and remote...