CVE-2026-81095 Timescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...

CVE-2026-81092 mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81092

mcp-go before 0.56.0 accepted HTTP requests on its Streamable HTTP and SSE transports without validating the Host header . Specifically, StreamableHTTPServer.ServeHTTP (server/streamable_http.go) and SSEServer.ServeHTTP (server/sse.go) served any request arriving over a loopback connection regard...

CVE-2026-81092 mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

EUVD-2026-67147

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81092 mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81091 mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the mcptarget parameter and proxied to it without inspecting the...

CVE-2026-81091

CVE-2026-81091 is a Server-Side Request Forgery (SSRF) in the proxy middleware of mcp-use's inspector . The vulnerable function mountMcpProxy (in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts) read the target URL from the X-Target-URL header or __mcp_target parameter and f...

CVE-2026-81091 mcp-use Inspector Proxy Server-Side Request Forgery via Caller-Supplied Target URL

The proxy middleware in mcp-use's inspector forwards requests to a destination the caller names. mountMcpProxy in libraries/typescript/packages/inspector/src/server/proxy/mcp-proxy.ts read the target from the X-Target-URL header or the mcptarget parameter and proxied to it without inspecting the...

CVE-2026-55553

A flaw was found in urllib. This HTTP client for Node.js can be exploited by a remote attacker due to improper handling of cross-origin redirects. When following redirects, urllib reuses sensitive request headers, such as Authorization and Cookie, across different origins. This can lead to the...

CVE-2026-63379

A flaw was found in Libevent, an event notification library. An unauthenticated remote attacker can exploit a vulnerability where chunked HTTP Hypertext Transfer Protocol trailers are incorrectly merged into request headers. This allows the attacker to place security-sensitive fields in trailers,...

CVE-2026-16732

A flaw was found in fastify. When configured with a numeric trustProxy value, an attacker who can directly access the Fastify origin, bypassing the front-facing proxy, can spoof forwarded request fields. This vulnerability allows for host injection in generated URLs, bypasses HTTPS enforcement, a...

CVE-2026-74747

A flaw was found in the Linux kernel's IP Virtual Server IPVS component. A local attacker can manipulate the IP Header Length ihl field within network packets. This manipulation can lead to an out-of-bounds access when the kernel attempts to revalidate embedded headers, potentially causing system...

CVE-2026-72813

A flaw was found in actix-files. This vulnerability allows a remote attacker to trigger a Denial of Service DoS by sending a GET request with an empty Range header when the application is configured to abort on panic. This can lead to the application crashing on demand. Mitigation Mitigation for...

CVE-2026-47892

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...

DEBIAN-CVE-2026-47892

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...

CVE-2026-47880

A producer who can publish to a JMS destination consumed by any Spring Integration JMS inbound component can set String JMS properties named replyChannel, errorChannel, or jsonTypeId which are copied verbatim into the Spring Integration MessageHeaders. Spring Integration 7.1.0 Spring Integration...

UBUNTU-CVE-2026-47892

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...

CVE-2026-47892

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...

EUVD-2026-66860

A WebFlux application using functional endpoints and deployed with DispatcherServlet may be vulnerable to a header predicate bypass in a pre-flight request. Spring Framework 7.0.0 - 7.0.8 Spring Framework 6.2.0 - 6.2.19 Spring Framework 6.1.0 - 6.1.28 Spring Framework 6.0.0 - 6.0.30 Spring...