GHSA-6PRH-2H8M-C8CW MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

Summary In affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin. If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers such as an X-API-Key set in requestInit.headers and the...

MCP TypeScript client SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies

Summary In affected versions, the SDK's HTTP client transports and OAuth requests followed redirects to any origin. If an MCP server or authorization server redirected a request to another origin, that origin received custom request headers such as an X-API-Key set in requestInit.headers and the...

Open Redirect

Overview @modelcontextprotocol/client is a Model Context Protocol implementation for TypeScript - Client package Affected versions of this package are vulnerable to Open Redirect via unconstrained redirect-following in the HTTP fetch layer used by auth.ts, sse.ts, and streamableHttp.ts. When the...

CLSA-2026-1792519677 apr-util: Fix of 2 CVEs

CVE-2026-32327: apr-util: stack recursion crash parsing deeply nested XML in aprxmlquoteelem - CVE-2026-34502: apr-util: heap buffer overflow in the APR memcached client...

CVE-2026-93210

A flaw was found in the Linux kernel's Server Message Block SMB client Distributed File System DFS cache. This vulnerability occurs due to improper handling of invalid target hints, specifically when a null pointer is dereferenced within the dfscachenorequpdatetgthint function. An attacker could...

CVE-2026-112949

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...

Apache bRPC resource management error vulnerability

Versions of Apache bRPC prior to 1.18.0 contain a resource management error vulnerability. This vulnerability arises because the Redis reply parser fails to limit recursion depth; as a result, remote peers on the Redis server return deeply nested RESP array replies, potentially causing the bRPC...

FreeRDP buffer error vulnerability

Versions of FreeRDP prior to 3.32.1 have a buffer error vulnerability. This vulnerability arises from the Android client not verifying the mappedWidth and mappedHeight values. An attacker can send a specially crafted RDP GFXMAPSURFACETOWINDOWPDU with an excessively large size, causing...

Cisco Secure Client input validation error vulnerability

Cisco Secure Client versions 4.9.00086, 4.9.01095, 4.9.02028, 4.9.03047, 4.9.03049, 4.9.04043, 4.9.04053, 4.9.05042, 4.9.06037, 4.10.00093, 4.10.01075, 4.10.02086, 4.10.03104, 4.10.04065, 4.10.04071, 4.10.05085, 4.10.05095, 5.0.00238, 4.10.05111, 5.0.00529, 5.0.00556, 4.10.06079, 5.0.01242,...

Improper handling of exceptions in Apache bRPC

Apache bRPC versions 1.11.0 and earlier contain an improper exception handling vulnerability. This vulnerability arises because the MySQL client response parser fails to check for null pointers or zero-length packets when processing them; instead, it reads the response type bytes directly, leadin...

FreeRDP resource management error vulnerability

FreeRDP version 3.32.0 contains a resource management error vulnerability. This vulnerability arises because the drdynvc channel uses an owned-stream reclaimer to release pools of streams when totalLength is less than the block size, resulting in post-release reuse. A malicious RDP server can sen...

CVE-2026-112949 Vitest: Code injection via unauthenticated manual mock registration

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...

CVE-2026-112949

The Vitest testing framework for JavaScript and TypeScript projects is vulnerable to code injection in versions 2.1.0-beta.7 through 4.1.12 and 5.0.3 . An unauthenticated non-browser WebSocket client capable of reaching a development server via interceptorPlugin can register a manual mock. Becaus...

CVE-2026-112949

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...

CVE-2026-112949 Vitest: Code injection via unauthenticated manual mock registration

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...

CVE-2026-112949 Vitest: Code injection via unauthenticated manual mock registration

Vitest is a Vite-native testing framework for JavaScript and TypeScript projects. From 2.1.0-beta.7 until 4.1.12 and 5.0.3, an unauthenticated non-browser WebSocket client that can reach a development server using interceptorPlugin can register a manual mock whose attacker-controlled url...

ai.covia:covia-claude-code (>=0.9.3, <=0.9.8), ai.covia:covia-discord (>=0.9.4, <=0.9.8) +101 more potentially affected by CVE-2026-111763 via org.a2aproject.sdk:a2a-java-sdk-client-transport-spi (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-client-transport-spi MAVEN version =1.0.0.alpha4, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.6, =0.6.0, =0.9.3, =0.4.0, =0.4.0, =0.1.0, =0.2.1.2-alpha, =0.6.0, =0.1.0, =0.1.0, =0.1.1, =0.1.2 and more Source cves: CVE-2026-111763 Source advisory: MEND:CVE-2026-111763...

ai.covia:covia-claude-code (>=0.9.3, <=0.9.8), ai.covia:covia-discord (>=0.9.4, <=0.9.8) +109 more potentially affected by CVE-2026-111763 via org.a2aproject.sdk:a2a-java-sdk-http-client (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-http-client MAVEN version =1.0.0.alpha4, =0.9.3, =0.9.4, =0.9.7, =0.8.0, =0.9.6, =0.6.0, =0.9.3, =0.4.0, =0.4.0, =0.1.0, =0.2.1.2-alpha, =0.6.0, =0.1.0, =0.1.0, =0.1.1, =0.1.2 and more Source cves: CVE-2026-111763 Source advisory: MEND:CVE-2026-111763...

org.a2aproject.sdk:a2a-java-sdk-compat-0.3-client (>=1.0.0.cr1, <=1.2.0.final), org.a2aproject.sdk:a2a-java-sdk-compat-0.3-client-transport-grpc (>=1.0.0.cr1, <=1.2.0.final) +4 more potentially affected by CVE-2026-111763 via org.a2aproject.sdk:a2a-java-sdk-compat-0.3-client-transport-spi (>=1.0.0.cr1, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-compat-0.3-client-transport-spi MAVEN version =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.final, =1.1.0.final - org.wildfly.a2a:a2a-jakarta-itk 1.0.0.cr2 Source cves: CVE-2026-111763 Source advisory: MEND:CVE-2026-111763...

CVE-2026-92287

A flaw was found in Apache Arrow and PyArrow. When reading encrypted Parquet files configured with a Key Management Service KMS client, unvalidated KMS server addresses embedded within the file can be passed directly to the client implementation. An attacker can supply a maliciously crafted Parqu...