1st-pi (>=0.1.0, <=0.1.1), @1mcp/agent (>=0.38.0, <=0.39.0-beta.3) +728 more potentially affected by CVE-2026-111769 via @modelcontextprotocol/client (>=2.0.0, <=2.2.0)

@modelcontextprotocol/client NPM version =2.0.0, =0.1.0, =0.38.0, =0.2.0, =0.1.0, =0.4.3, =0.4.1, =0.4.1, =0.1.7-rc.0, =13.0.0-rc.4, =0.3.0, =0.1.0, =0.0.5, =0.7.0, =0.8.0 and more Source cves: CVE-2026-111769 Source advisory: MEND:CVE-2026-111769...

CVE-2026-86411

An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...

CVE-2026-86415

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

EUVD-2026-105307

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CVE-2026-86415

libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already authenticated Schannel connection can be handed to a transfer that got redirected to a different origin, even though the code explicitly switched off the auto client cert option...

CVE-2026-86411

A flaw in curl allows unauthorized access due to improper session reuse. When an unencrypted FTP transfer reuses a pooled control connection that was previously authenticated with a client certificate and upgraded via STARTTLS , curl fails to perform a new TLS handshake or authentication. Consequ...

CVE-2026-86411 FTP connection reuse inherits client-certificate

An ftp:// transfer configured with CURLUSESSLNONE can reuse a pooled FTP control connection that a previous easy handle upgraded with STARTTLS and authenticated using a client certificate. The second handle performs neither a new TLS handshake nor a new FTP login, so the server continues to...

polyswarm-api (>=0.1.0, <=0.2.2), polyswarm-client (>=1.0.0rc0, <=1.0.2) +1 more potentially affected by CVE-2026-111748 via aiohttp (2.3.1)

aiohttp PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - polyswarm-api =0.1.0, =1.0.0rc0, =0.2.0a7, =0.2.0a10 Source cves: CVE-2026-111748 Source advisory: OSV:GHSA-F9XW-JH8M-3MWQ...

polyswarm-api (>=0.1.0, <=0.2.2), polyswarm-client (>=1.0.0rc0, <=1.0.2) +1 more potentially affected by CVE-2026-111749 via aiohttp (2.3.1)

aiohttp PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - polyswarm-api =0.1.0, =1.0.0rc0, =0.2.0a7, =0.2.0a10 Source cves: CVE-2026-111749 Source advisory: OSV:GHSA-GX76-C99X-2C96...

polyswarm-api (>=0.1.0, <=0.2.2), polyswarm-client (>=1.0.0rc0, <=1.0.2) +1 more potentially affected by CVE-2026-111065 via aiohttp (2.3.1)

aiohttp PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - polyswarm-api =0.1.0, =1.0.0rc0, =0.2.0a7, =0.2.0a10 Source cves: CVE-2026-111065 Source advisory: OSV:GHSA-6CJC-53GC-5RQM...

aiodocker (0.7.0), aiopogo (>=1.6.0b1, <=2.0.0) +10 more potentially affected by CVE-2026-111750 via aiohttp (2.0.7)

aiohttp PYPI version 2.0.7 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - aiodocker 0.7.0 - aiopogo =1.6.0b1, =0.1.0, =0.1.0, =0.42.4, =0.0.1, =0.9.6, =1.1.0, =1.3.3 Source cves: CVE-2026-111750 Source advisory:...

polyswarm-api (>=0.1.0, <=0.2.2), polyswarm-client (>=1.0.0rc0, <=1.0.2) +1 more potentially affected by CVE-2026-111750 via aiohttp (2.3.1)

aiohttp PYPI version 2.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on aiohttp and may be impacted: - polyswarm-api =0.1.0, =1.0.0rc0, =0.2.0a7, =0.2.0a10 Source cves: CVE-2026-111750 Source advisory: OSV:GHSA-PQXQ-W44R-73XW...

Cross-site Scripting (XSS)

Overview apostrophe is a content management system CMS for Node.js. It supports in-context editing, schema-driven content types, flexible widgets and a great deal more. This module contains everything necessary to build a website with ApostropheCMS. Affected versions of this package are vulnerabl...

GHSA-6PRH-2H8M-C8CW MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

Summary In affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin. If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers such as an X-API-Key set in requestInit.headers and the...

1st-pi (>=0.1.0, <=0.1.1), @1mcp/agent (>=0.38.0, <=0.39.0-beta.3) +728 more potentially affected by CVE-2026-111769 via @modelcontextprotocol/client (>=2.0.0, <=2.2.0)

@modelcontextprotocol/client NPM version =2.0.0, =0.1.0, =0.38.0, =0.2.0, =0.1.0, =0.4.3, =0.4.1, =0.4.1, =0.1.7-rc.0, =13.0.0-rc.4, =0.3.0, =0.1.0, =0.0.5, =0.7.0, =0.8.0 and more Source cves: CVE-2026-111769 Source advisory: GHSA-6PRH-2H8M-C8CW...

1st-pi (>=0.1.0, <=0.1.1), @1mcp/agent (>=0.38.0, <=0.39.0-beta.3) +728 more potentially affected by CVE-2026-111769 via @modelcontextprotocol/client (>=2.0.0, <=2.2.0)

@modelcontextprotocol/client NPM version =2.0.0, =0.1.0, =0.38.0, =0.2.0, =0.1.0, =0.4.3, =0.4.1, =0.4.1, =0.1.7-rc.0, =13.0.0-rc.4, =0.3.0, =0.1.0, =0.0.5, =0.7.0, =0.8.0 and more Source cves: CVE-2026-111769 Source advisory: OSV:GHSA-6PRH-2H8M-C8CW...

1st-pi (>=0.1.0, <=0.1.1), @1mcp/agent (>=0.38.0, <=0.39.0-beta.3) +728 more potentially affected by CVE-2026-111769 via @modelcontextprotocol/client (>=2.0.0, <=2.2.0)

@modelcontextprotocol/client NPM version =2.0.0, =0.1.0, =0.38.0, =0.2.0, =0.1.0, =0.4.3, =0.4.1, =0.4.1, =0.1.7-rc.0, =13.0.0-rc.4, =0.3.0, =0.1.0, =0.0.5, =0.7.0, =0.8.0 and more Source cves: CVE-2026-111769 Source advisory: SNYK:JS-MODELCONTEXTPROTOCOLCLIENT-21369531...

MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

Summary In affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin. If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers such as an X-API-Key set in requestInit.headers and the...

Open Redirect

Overview @modelcontextprotocol/client is a Model Context Protocol implementation for TypeScript - Client package Affected versions of this package are vulnerable to Open Redirect via unconstrained redirect-following in the HTTP fetch layer used by auth.ts, sse.ts, and streamableHttp.ts. When the...

CLSA-2026-1792519677 apr-util: Fix of 2 CVEs

CVE-2026-32327: apr-util: stack recursion crash parsing deeply nested XML in aprxmlquoteelem - CVE-2026-34502: apr-util: heap buffer overflow in the APR memcached client...