13 matches found
CVE-2026-23520
CVE-2026-23520 PoC di Esecuzione Remota di Comandi RCE tramite API MCP 📌 Panoramica Questo repository contiene un Proof-of-Concept PoC per una vulnerabilità di Esecuzione Remota di Comandi RCE che colpisce applicazioni che espongono un endpoint API MCP vulnerabile comunemente /api/mcp/connect. La...
CVE-2026-71424
Onyx is an open-source AI platform. Prior to 3.1.10, 3.2.14, and 4.0.0, Onyx's GET /api/mcp/servers and GET /api/mcp/servers/persona/personaid endpoints expose another user's OAuth Authorization header because OnyxTokenStorage.settokens and OnyxTokenStorage.setclientinfo in...
CVE-2026-19040
A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to...
CVE-2026-19041
The CVE-2026-19041 entry impacts MissionSquad mcp-api up to version 1.11.8. The vulnerability resides in the function this.packageService.installPackage within src/controllers/packages.ts (NPM Package Version Handler) and enables command injection. Exploit appears possible remotely, with a remedi...
CVE-2026-19040
MissionSquad mcp-api (versions
EUVD-2026-53924
A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to...
CVE-2026-19040 MissionSquad mcp-api dcrClients.ts server-side request forgery
A flaw has been found in MissionSquad mcp-api up to 1.11.9. The affected element is an unknown function of the file src/services/dcrClients.ts. Executing a manipulation can lead to server-side request forgery. The attack may be performed from remote. Upgrading to version 1.11.10 is sufficient to...
CVE-2026-62312 9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments
9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP plugin args passed to childprocess.spawn, allowing...
CVE-2026-10280
A security flaw has been discovered in horizon921 mcpilot 0.1.0. The impacted element is an unknown function of the file client/src/app/api/mcp/call/route.ts of the component MCP API Call Endpoint. The manipulation of the argument serverBaseUrl results in server-side request forgery. The attack c...
PT-2026-45501
Name of the Vulnerable Software and Affected Versions horizon921 mcpilot version 0.1.0 Description A server-side request forgery SSRF exists in the MCP API Call Endpoint within the file client/src/app/api/mcp/call/route.ts. This issue allows a remote attacker to manipulate the serverBaseUrl...
Exploit for Missing Authentication for Critical Function in Mcpjam Inspector
HackTheBox — DevHub CVE-2026-23744 | MCPJam Inspector Unaut...