PT-2026-106750

Name of the Vulnerable Software and Affected Versions Microsoft UFO versions prior to 3.0.9 Description The press key tool in ufo/client/mcp/http servers/mobile mcp server.py accepts a free-form key code parameter and passes it to adb shell input keyevent. The adb client joins the arguments into ...

PT-2026-106738

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.10, the type text and launch app tools in ufo/client/mcp/http servers/mobile mcp server.py pass the authenticated caller-controlled text and package name parameters into adb shell comma...

PT-2026-106739

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the execute command tool in ufo/client/mcp/http servers/linux mcp server.py treats sort and uniq as read-only commands while the free-form command parameter can select their...

PT-2026-106748

Microsoft UFO is an open-source framework for intelligent automation across devices and platforms. Prior to 3.0.9, the run shell tool in the CommandLineExecutor component of ufo/client/mcp/local servers/cli mcp server.py validates only the first token of the bash command parameter and permits...

PT-2026-69320

Name of the Vulnerable Software and Affected Versions dmitriiweb article-scraper-mcp version 1.0.0 Description A remote attacker can perform server-side request forgery SSRF, a technique that allows a server to be coerced into making requests to an unintended location, by manipulating the url...