EUVD-2026-54938

A vulnerability was identified in Ichigo3766 image-gen-mcp 0.1.0. The impacted element is an unknown function of the file src/index.ts of the component upscaleimages. Such manipulation of the argument outputpath leads to path traversal. The attack must be carried out locally. The project was...

CVE-2026-19338

A vulnerability was identified in automateyournetwork MCPyATS up to 0.1.4. The affected element is the function processGenerateRequest of the file mcpservers/mermaid/index.ts of the component generatemermaidmarkdown. The manipulation of the argument folder/name leads to path traversal. The attack...

CVE-2026-19338

CVE-2026-19338 affects automateyournetwork MCPyATS up to 0.1.4, specifically the function processGenerateRequest in mcp_servers/mermaid/index.ts of the generate_mermaid_markdown component. The vulnerability stems from path traversal caused by manipulating the folder/name argument, with the attack...

CVE-2026-19335 Jane-xiaoer skill-vision-control config.ts getSkillVersionsDir path traversal

A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc/utils/config.ts. Such manipulation of the argument skillName leads to path traversal. The attack can only be performed from a local...

EUVD-2026-54871

A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This affects an unknown part of the file src/index.ts. This manipulation of the argument name/modelfile/source/destination causes command injection. The attack can only be executed locally. This product ...

CVE-2026-19333

NightTrek Supabase-MCP contains a command injection vulnerability in the generate_types component. The manipulation of the argument schema enables local execution of commands. Affected functionality is described as unknown in the documentation, with exploitation requiring local access. The CVE en...

EUVD-2026-54870

A vulnerability was detected in NightTrek Supabase-MCP cc994ab2d2a36b0af6ee7c7f3e6ce8e08cda2170/db03237d92f7dc2f0da0d70a87dba84ebcde5b66. Affected by this issue is some unknown functionality of the component generatetypes. The manipulation of the argument schema results in command injection. The...

CVE-2026-19329

A vulnerability was found in andreahaku codexmcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. The affected element is an unknown function of the file src/codex-process-simple.ts of the component ask MCP Tool. The manipulation of the argument model results in command injection. The attack...

CVE-2026-19331 bazylhorsey obsidian-mcp-server CanvasService.ts writeCanvas path traversal

A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0. This affects the function readCanvas/writeCanvas of the file src/services/CanvasService.ts. Such manipulation leads to path traversal. An attack has to be approached locally. The project was informed of the problem early...

EUVD-2026-54868

A vulnerability was identified in bazylhorsey obsidian-mcp-server 1.0.0. This affects the function readCanvas/writeCanvas of the file src/services/CanvasService.ts. Such manipulation leads to path traversal. An attack has to be approached locally. The project was informed of the problem early...

CVE-2026-19329 andreahaku codex_mcp ask MCP Tool codex-process-simple.ts command injection

A vulnerability was found in andreahaku codexmcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. The affected element is an unknown function of the file src/codex-process-simple.ts of the component ask MCP Tool. The manipulation of the argument model results in command injection. The attack...

EUVD-2026-54862

A vulnerability was found in andreahaku codexmcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. The affected element is an unknown function of the file src/codex-process-simple.ts of the component ask MCP Tool. The manipulation of the argument model results in command injection. The attack...

CVE-2026-19327

A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is calle...

CVE-2026-19325

A security vulnerability has been detected in IncomeStreamSurfer roo-code-memory-bank-mcp-server up to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e. This affects the function readMemoryBankFile/appendMemoryBankEntry of the file src/index.ts of the component readmemorybankfile/appendmemorybankentry...

CVE-2026-19328

A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed...

CVE-2026-19327 abracadabra50 claude-sesh enricher.ts enrichSession path traversal

A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is calle...

CVE-2026-19327 abracadabra50 claude-sesh enricher.ts enrichSession path traversal

A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is calle...

CVE-2026-19326

A vulnerability was detected in Jevon-Zhong Ai-doctor 0.0.1. This vulnerability affects the function deleteImage of the file ai-doctor-server/src/filemanagement/filemanagement.service.ts. Performing a manipulation of the argument imagePath results in path traversal. The attack must be initiated...

CVE-2026-19325

IncomeStreamSurfer roo-code-memory-bank-mcp-server exposes a local path traversal in read_memory_bank_file/append_memory_bank_entry (readMemoryBankFile/appendMemoryBankEntry) affecting src/index.ts. The attack hinges on manipulating file_name to traverse directories. Details in CVE-2026-19325 ind...

EUVD-2026-54852

A security vulnerability has been detected in IncomeStreamSurfer roo-code-memory-bank-mcp-server up to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e. This affects the function readMemoryBankFile/appendMemoryBankEntry of the file src/index.ts of the component readmemorybankfile/appendmemorybankentry...