PT-2026-53798

Impact Uni-CLI versions before 0.225.2 exposed the legacy JSON-RPC-over-HTTP MCP transport on loopback without validating browser Origin headers before routing requests. A malicious web page could send a CORS simple POST request, such as text/plain, to the local /mcp endpoint and deliver a JSON-R...

Localhost Boundary Bypass

kubernetes is vulnerable to localhost boundary bypass. Due to insecure API Server's default port setting, TCP and UDP services on the nodes which are bound to 127.0.0.1 are reachable by adjacent hosts or by containers running on the same node as the service...