1224 matches found
CVE-2026-19288
A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-server/src/tools/importRiveFile.ts of the component importRiveFile Flow. Such manipulation of the argument libraryId leads to pa...
CVE-2026-19288
A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-server/src/tools/importRiveFile.ts of the component importRiveFile Flow. Such manipulation of the argument libraryId leads to pa...
CVE-2026-19288 astralisone rive-mcp-server-core importRiveFile Flow importRiveFile.ts path traversal
A vulnerability has been found in astralisone rive-mcp-server-core up to db1d0cc4cd52589116360428b7504fd0ca748b3e. This affects an unknown part of the file packages/mcp-server/src/tools/importRiveFile.ts of the component importRiveFile Flow. Such manipulation of the argument libraryId leads to pa...
PT-2026-69200
Name of the Vulnerable Software and Affected Versions astralisone rive-mcp-server-core versions up to db1d0cc4cd52589116360428b7504fd0ca748b3e Description A path traversal issue exists in the importRiveFile Flow component within the file packages/mcp-server/src/tools/importRiveFile.ts. A local...
CVE-2026-19039
A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function sshexec of the file src/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host/username results in command injection. The...
@apicity/mcp-server (0.8.4) potentially affected by unknown CVE via @apicity/meta (0.8.4)
@apicity/meta NPM version 0.8.4 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.4 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...
@apicity/mcp-server (0.8.1) potentially affected by unknown CVE via @apicity/meta (0.8.1)
@apicity/meta NPM version 0.8.1 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.1 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...
@apicity/mcp-server (0.8.8) potentially affected by unknown CVE via @apicity/meta (0.8.8)
@apicity/meta NPM version 0.8.8 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.8 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...
@apicity/mcp-server (0.8.3) potentially affected by unknown CVE via @apicity/meta (0.8.3)
@apicity/meta NPM version 0.8.3 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.3 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...
@apicity/mcp-server (0.8.6) potentially affected by unknown CVE via @apicity/meta (0.8.6)
@apicity/meta NPM version 0.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.6 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...
@apicity/mcp-server (0.8.2) potentially affected by unknown CVE via @apicity/meta (0.8.2)
@apicity/meta NPM version 0.8.2 is affected by a known vulnerability. The following packages have a transitive dependency on @apicity/meta and may be impacted: - @apicity/mcp-server 0.8.2 Source cves: unknown CVE Source advisory: OSV:MAL-2026-13412...
CVE-2026-19039 Kino-Kafkaesque ssh-mcp-server SSH index.ts ssh_exec command injection
A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function sshexec of the file src/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host/username results in command injection. The...
EUVD-2026-53877
A vulnerability was detected in Kino-Kafkaesque ssh-mcp-server up to 8ebbbb99b26f80ff6162fe00957c6dec73fbc5a5. Impacted is the function sshexec of the file src/index.ts of the component SSH Command Handler. Performing a manipulation of the argument host/username results in command injection. The...
CVE-2026-19039
The vulnerability CVE-2026-19039 affects Kino-Kafkaesque ssh-mcp-server (SSH Command Handler) specifically the function ssh_exec in src/index.ts. The issue arises from manipulation of the host/username argument, enabling command injection. Exploitation is described as a local attack, with the thr...
CVE-2026-18954 Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode...
CVE-2026-18954 Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server
Incorrect authorization in the aggregation pipeline tool in Amazon AWS Labs DocumentDB MCP Server before 1.0.12 might allow an authenticated MCP client to perform inappropriate write operations on the connected database via write-capable aggregation pipeline stages that bypass the read-only mode...
CVE-2026-18954
CVE-2026-18954 : Affected product is Amazon AWS Labs DocumentDB MCP Server prior to 1.0.12. The issue is incorrect authorization in the aggregation pipeline tool that could allow a authenticated MCP client to perform write operations via write-capable aggregation pipeline stages, bypassing the re...
CVE-2026-18953
Improper limitation of a pathname to a restricted directory in the getresource tool in Amazon awslabs.aws-transform-mcp-server 0.1.0 through 0.1.4 might allow a context-dependent actor to write arbitrary files outside the intended working directory via the savePath parameter. To remediate this...
CVE-2026-9077
IBM Langflow OSS 1.0.0 through 1.10.3 Langflow allows remote authenticated attackers to bypass localhost-only restrictions and write arbitrary MCP server configurations to IDE configuration files on the host system...