Security-Detections-MCP

Security Detections MCP Un servidor MCP Model Context Protocol que permite a los LLMs consultar una base de datos unificada de reglas de detección de seguridad Sigma , Splunk ESCU , Elastic , KQL , Sublime y CrowdStrike CQL. ¿Eres nuevo? Empieza con laGuía de configuración — cubre macOS, Windows...

Query-Hub

CQL-Hub | CrowdStrike SIEM & LogScale Queries Welcome to the CQL-Hub Backend Repository This repository powers cql-hub.com: A free, community-driven hub for CrowdStrike Falcon SIEM queries. All queries stored here are automatically published and made visible on the CQL-Hub website, making it easi...

GeoServer jsonArrayContains CQL Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single...

GeoServer OGC Filter - SQL Injection

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language CQL as part of the Web Feature Service WFS and Web Map Service WMS protocols. CQL is...

CVE-2023-25157-GeoServer-SQLi-Lab

GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-25158 — Laboratorio de Vulnerabilidad e Informe de PoC Entorno de práctica Laboratorio Vulnerable e informe detallado de análisis de explotación de la vulnerabilidad SQL Injection Error-based en GeoServer CVE-2023-25157 y la biblioteca...

PYSEC-2026-4102 MCP Atlassian: JIRA_PROJECTS_FILTER / CONFLUENCE_SPACES_FILTER allow forbidden-project content exfiltration (one LIVE-proven on Atlassian Cloud)

Summary mcp-atlassian is a popular community MCP server wrapper exposing Jira / Confluence to MCP clients. Operators commonly restrict the surface to a small allowlist of projects/spaces via the JIRAPROJECTSFILTER and CONFLUENCESPACESFILTER environment variables, which the README documents as the...

PT-2026-105852

Summary mcp-atlassian is a popular community MCP server wrapper exposing Jira / Confluence to MCP clients. Operators commonly restrict the surface to a small allowlist of projects/spaces via the JIRA PROJECTS FILTER and CONFLUENCE SPACES FILTER environment variables, which the README documents as...

PT-2026-78872

Уязвимость функции jsonArrayContains библиотеки GeoTools программного обеспечения для администрирования и публикации геоданных на сервере OSGeo GeoServer связана с непринятием мер по защите структуры SQL-запроса при обработке параметра CQL FILTER. Эксплуатация уязвимости может позволить нарушител...

Exploit for SQL Injection in Osgeo Geoserver

GeoServer & GeoTools SQL Injection CVE-2023-25157 & CVE-2023-...

PYSEC-2026-2897 PraisonAI knowledge-store backends interpolate unvalidated collection names into SQL and CQL queries

Summary PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names into these backends can trigger SQL or CQL injection. Details This issue affec...

PT-2026-59534

Summary PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names into these backends can trigger SQL or CQL injection. Details This issue affec...

GHSA-Q65P-7P84-495C Duplicate Advisory: PraisonAI: PGVector and Cassandra knowledge stores interpolate vector dimensions into DDL

Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-wf65-4jjx-q444. This link is maintained to preserve external references. Original Description PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra...

CVE-2026-60090: Improper Neutralization of Special Elements used in an SQL Command

PraisonAI before 4.6.78 fails to validate the caller-controlled dimension argument in the PGVector and Cassandra knowledge-store createcollection backends. Although schema, keyspace, and collection-name identifiers are validated, the dimension value declared as int but not enforced at runtime is...

CVE-2026-44337

PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names...

CVE-2026-44337

PraisionAI across versions 2.4.1–4.6.34 exposes optional SQL/CQL-backed knowledge-store backends that derive table and index identifiers from unvalidated collection names. This can enable SQL/CQL injection when applications pass untrusted collection names into these backends. The issue is fixed i...

CVE-2026-44337: Improper Input Validation

PraisonAI is a multi-agent teams system. From version 2.4.1 to before version 4.6.34, PraisonAI exposes optional SQL/CQL-backed knowledge-store implementations that build table and index identifiers from unvalidated name and collection arguments. Applications that pass untrusted collection names...

EUVD-2026-23992

Glances has CQL Injection in its Cassandra Export Module via Unsanitized Config Values...

PYSEC-2026-2177

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module glances/exports/glancescassandra/init.py interpolates keyspace, table, and replicationfactor configuration values directly into CQL statements without validation. A user with write...

CVE-2026-35588: Improper Neutralization of Special Elements used in an SQL Command

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module glances/exports/glancescassandra/init.py interpolates keyspace, table, and replicationfactor configuration values directly into CQL statements without validation. A user with write...

CVE-2026-35588

Glances is an open-source system cross-platform monitoring tool. Prior to version 4.5.4, the Cassandra export module glances/exports/glancescassandra/init.py interpolates keyspace, table, and replicationfactor configuration values directly into CQL statements without validation. A user with write...