http-mcp-bridge

HTTP MCP Bridge 이 프로젝트는 mcp 파이썬 라이브러리GitHub를 사용하여 HTTP/1.1 요청과 원격 MCP 서버 간의 브리지 역할을 하는 HTTP 서버를 구현합니다. 이 이니셔티브의 주요 목적은 원격 전송 메커니즘HTTP+SSE 또는 Streamable HTTP을 사용하는 원격 MCP 서버를 테스트하기 위해 HTTP 보안 도구를 사용할 수 있게 하는 것입니다. 중요 참고 사항! 동일한 id를 가진 JSON-RPC-V2 메시지를 동시 스레드로 전송할 때 응답이 병합될 수 있다는 것이 관찰되었습니다. 평가 시 도...

mcpsnoop

Wireshark for MCP. mcpsnoop sits between your AI client and your MCP server and records every JSON-RPC frame they exchange, with no change to either side. Watch it live in your terminal, fail CI on what it finds, or send it to your tracing backend as OpenTelemetry spans. The problem The official...

CVE-2024-49369

CVE-2024-49369 개요 이 취약점은 Icinga JSON-RPC 프로토콜을 이용하여 Icinga 에이전트를 실행 중인 모니터링 노드를 공격합니다. Master/Satellite 인스턴스를 사칭함으로써 공격자는 에이전트를 장악하고, 임의 명령을 실행하거나, 민감한 정보를 획득할 수 있습니다. 사용 방법 스캔 취약한 에이전트를 서브넷에서 스캔하려면 다음 명령을 실행하세요: python3 main.py scan --subnet 192.168.0.0/24 --vuln --batch 25 이 명령은 지정된 서브넷을 25개 IP...

neto

Project Neto: A Toolkit for Analysing Browser Plugins Overview Project Neto is a Python 3 package conceived to analyse and unravel hidden features of browser plugins and extensions for well-known browsers such as Firefox and Chrome. It automates the process of unzipping the packaged files to...

web3-decoder

Web3 Decoder Web3 Decoder는 web3 스마트 계약과 관련된 작업에서 어떤 일이 일어나고 있는지 분석하는 데 도움을 주는 Burp Suite 확장 프로그램입니다. 주로 이더리움 노드 및 기타 호환 네트워크Polygon, Arbitrum, BSC 등의 노드에 대한 JSON-RPC 호출을 분석합니다. 다운로드 및 설치 최신 확장 프로그램 JAR를 다운로드하세요 — 이 링크는 항상 최신 릴리스를 제공합니다: ⬇ web3-decoder.jar 최신 이전 버전은 릴리스 페이지에서 확인할 수 있습니다. 그런 다음 Bur...

lisa.py

LLDB MCP 통합 이 프로젝트는 LLDB에 대한 모델-컨텍스트 프로토콜MCP 통합을 제공하여, Claude와 같은 AI 어시스턴트가 표준화된 인터페이스를 통해 디버깅 세션과 상호작용할 수 있도록 합니다. 개요 통합은 두 가지 주요 구성 요소로 이루어져 있습니다: 1. server.py - Claude또는 다른 MCP 클라이언트와 통신하는 MCP 서버 2. lldbplugin.py - LLDB 내부에서 실행되며 JSON-RPC를 통해 디버거 기능을 노출하는 플러그인 이 아키텍처를 통해 Claude는 자연어로 직접 LLDB와...

web3-decoder

Web3 Decoder Web3 Decoder は、ブロックチェーン操作とスマートコントラクトのやり取りを分析するために設計された Burp Suite 拡張機能です。Ethereum および互換性のあるネットワーク（Polygon、Arbitrum、BSC など）への JSON-RPC 呼び出しを処理します。 ブロックエクスプローラー API キー etherscan.io など、サポートされているほとんどのブロックエクスプローラーでは、5 秒間に 1 回以上のリクエストを許可するために API キーが必要です。 API キーを追加するには 2 つのオプションがあります:...

CVE-2026-19807

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

CVE-2026-19807 ByteCoreStack <= 1.2.3 - Authenticated (Subscriber+) Privilege Escalation via wp_update_user_meta MCP Tool

The ByteCoreStack – MCP Connector for AI Tools plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.3 This is due to the wpupdateusermeta MCP tool in executetool gating writes solely with currentusercan'edituser', $uid — a check that WordPress core'...

Exposure Of Data Element To The Wrong Session

Apache Struts is vulnerable to an exposure of data element to the wrong session. The vulnerability is due to per-response serialization state being shared across concurrent requests in the SMD/JSON-RPC handling of the JSON interceptor, which allows an attacker to potentially observe response...

MCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass

Summary ENABLEDTOOLS and TOOLSETS filters are enforced at tools/list time only. tools/call dispatches from the full unfiltered tool registry 73 tools. Any user with access to the server endpoint that knows a tool name can invoke it directly. Tool names are not secret since mcp-atlassian is open...

PT-2026-96709

Name of the Vulnerable Software and Affected Versions ZenHive mpp versions 0.14.0 through 0.16.1 Description Improper validation of the specified quantity in the input allows a client with an open payment channel to obtain paid resources without being charged. The function accept voucher/3 in...

CVE-2026-94050

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...

CVE-2026-94050 D-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosure

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...

EUVD-2026-83787

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...

CVE-2026-94050

An information disclosure vulnerability affects the ubus JSON-RPC interface of the D-Link DIR-X1860Z wireless router (firmware up to 1.0.2.220120.165402). The vulnerable functions are routerd.wificfg_get and routerd.get_rand_key , where manipulation allows an attacker on the local network to retr...

CVE-2026-94050 D-Link DIR-X1860Z ubus JSON-RPC interface routerd.get_rand_key information disclosure

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...

CVE-2026-94050: Exposure of Sensitive Information to an Unauthorized Actor

A vulnerability has been found in D-Link DIR-X1860Z up to 1.0.2.220120.165402. Affected is the function routerd.wificfgget/routerd.getrandkey of the component ubus JSON-RPC interface. Such manipulation leads to information disclosure. The attack must be carried out from within the local network...

PT-2026-96007

Name of the Vulnerable Software and Affected Versions D-Link DIR-X1860Z versions prior to 1.0.7.260821.161908 Description An issue exists in the ubus JSON-RPC interface where manipulation of the routerd.wificfg get and routerd.get rand key functions can lead to information disclosure. This attack...

CVE-2026-61550

Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that the sender is a trusted endpoint. An unauthenticated network attacker able to connect to TCP port 5665 can replace the node certificate and...