CVE-2026-81098 Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they wer...

EUVD-2026-67026

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they wer...

CVE-2026-81098

The Telnyx MCP server (telnyx-node package through 6.83.0 ) exposed its Streamable HTTP transport on all network interfaces without requiring caller credentials. The vulnerable component, packages/mcp-server/src/http.ts, bound its listener to every interface and parsed authentication headers in a...

CVE-2026-81098 Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they wer...

CVE-2026-81098 Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. packages/mcp-server/src/http.ts served MCP on the root path with a listener bound to all interfaces and parsed the caller's authentication headers in a mode that did not fail when they wer...

EUVD-2026-67023

pg-aiguide started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named. A page in a brows...

CVE-2026-81092 mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81092

mcp-go before 0.56.0 accepted HTTP requests on its Streamable HTTP and SSE transports without validating the Host header . Specifically, StreamableHTTPServer.ServeHTTP (server/streamable_http.go) and SSEServer.ServeHTTP (server/sse.go) served any request arriving over a loopback connection regard...

CVE-2026-81092 mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2026-81092 mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

EUVD-2026-67147

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamablehttp.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's...

CVE-2017-5638

CVE-2017-5638 Le versioni di Apache Struts 2 2.3.x precedenti alla 2.3.32 e 2.5.x precedenti alla 2.5.10.1 presentano un difetto nel parser Jakarta Multipart. Questo difetto provoca una gestione errata delle eccezioni e la generazione di messaggi di errore quando si tenta di caricare file. Di...

cve-2020-14882

cve-2020-14882 uso: cve-2020-14882.py http://127.0.0.1...

CVE-2018-5354

CVE-2018-5354 Client di Reset Password ANIXIS - Escalation di Privilegi / RCE Informazioni Vendor: ANIXIS Prodotto: Client di Reset Password ANIXIS Versioni interessate: Prima della versione 3.22 Ricercatore: Jason Juntunen aka @missing0x00 https://github.com/missing0x00 CVSS: 8.8 Descrizione Il...

CVE-2020-14882

CVE-2020-14882 CVE-2020-14882 Descrizione Vulnerabilità nel prodotto Oracle WebLogic Server di Oracle Fusion Middleware componente: Console. Le versioni supportate interessate sono 10.3.6.0.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 e 14.1.1.0.0. Una vulnerabilità facilmente sfruttabile consente a un...

CVE-2021-41773-PoC

CVE-2021-41773-PoC PoC per CVE-2021-41773 con docker per dimostrare Esecuzione Esegui semplicemente ./poc.sh. Assicurati di avere docker e docker-compose funzionanti root@kitploit: $ ./poc.sh Creating network "cve-2021-41773-pocdefault" with the default driver Creating cve-2021-41773-pocweb1...

CVE-2021-41773-L-

CVE-2021-41773 🐛 Vulnerabilità di path traversal e divulgazione di file in Apache HTTP Server 2.4.49 È stato trovato un difetto in una modifica apportata alla normalizzazione dei percorsi in Apache HTTP Server 2.4.49. Un attaccante potrebbe utilizzare un attacco di path traversal per mappare gli...

cve-2023-33476

CVE-2023-33476 ReadyMedia MiniDLNA dalla versione 1.1.15 fino alla 1.3.2 è vulnerabile a Buffer Overflow. La vulnerabilità è causata da una logica di validazione errata durante la gestione delle richieste HTTP che utilizzano la codifica di trasporto a chunk. Ciò fa sì che altro codice utilizzi...

sickrageWTF

Credenziali GitHub in chiaro di Sickrage CVE-2018-9160 1. Informazioni Titolo dell'exploit: Credenziali in chiaro di SickRage nella risposta HTTP Data: 2018-04-01 Autore dell'exploit: Sven Fassbender Contatto: https://twitter.com/mezdanak Homepage del fornitore: https://sickrage.github.io Link de...

CVE-2019-10092

CVE-2019-10092: Cross-Site Scripting limitato tramite pagina "Proxy Error" in Apache HTTP Server In Apache HTTP Server 2.4.0-2.4.39, è stato segnalato un problema di cross-site scripting limitato che interessava la pagina di errore di modproxy. Un aggressore potrebbe causare la deformazione del...