Lucene search
+L

4403 matches found

Cvelist
Cvelist
added 2026/09/04 11:29 a.m.36 views

CVE-2026-85580 SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive...

7.1CVSS0.00526EPSS
SaveExploits0References2
CVE
CVE
added 2026/09/04 11:29 a.m.9 views

CVE-2026-85580

SiYuan versions before v3.8.2 contain a path guard bypass in the MCP file-access handler , caused by case-sensitive matching on Linux filesystems. An attacker with low privileges can read the protected publishAccess.json file by requesting a case-variant path (e.g., PublishAccess.json), disclosin...

7.1CVSS5.2AI score0.00526EPSS
SaveExploits0References2
EUVD
EUVD
added 2026/09/04 11:29 a.m.8 views

EUVD-2026-71003

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive...

7.1CVSS5.4AI score0.00526EPSS
SaveExploits0References2
OSV
OSV
added 2026/09/04 11:29 a.m.11 views

CVE-2026-85580 SiYuan before v3.8.2 Path Guard Bypass via Case Mismatch

SiYuan versions before v3.8.2 contain a path guard bypass vulnerability in the MCP file-access handler that uses case-sensitive matching on Linux filesystems. Attackers can read the protected publishAccess.json file by requesting case-variant paths like PublishAccess.json to disclose sensitive...

7.1CVSS5.5AI score
SaveExploits0References4
Snyk
Snyk
added 2026/09/04 6:31 a.m.6 views

Malicious Package

Overview mcp-consultasdeveiculos-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and thi...

9.8CVSS5.8AI score
SaveExploits0References2
Positive Technologies
Positive Technologies
added 2026/09/04 12:00 a.m.12 views

PT-2026-85539

firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl parse tool that accepts unconstrained filePath arguments without directory containment validation. Attackers can supply absolute paths or directory traversal sequences to read sensitive files like...

8.7CVSS5.5AI score0.00702EPSS
SaveExploits0References6
Positive Technologies
Positive Technologies
added 2026/09/04 12:00 a.m.15 views

PT-2026-85550

git-mcp-server 2.15.1 contains an argument injection vulnerability in the ref and object parameters of git log, git diff, and git show tools that lack leading-dash validation. Attackers can inject git command-line options like --output= to write files outside the repository to arbitrary paths...

8.7CVSS5.4AI score0.0027EPSS
SaveExploits0References7
Positive Technologies
Positive Technologies
added 2026/09/04 12:00 a.m.13 views

PT-2026-85554

excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL FILES PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process...

9.8CVSS5.5AI score0.00441EPSS
SaveExploits0References11
Positive Technologies
Positive Technologies
added 2026/09/04 12:00 a.m.16 views

PT-2026-85544

Postgres MCP Pro 0.3.0 contains a restricted-mode bypass vulnerability where function-name validation is not applied to RangeFunction nodes in FROM clauses. Attackers can execute file-reading functions like pg read file through FROM-clause syntax to read arbitrary files despite restricted-mode...

9.2CVSS5.6AI score0.00371EPSS
SaveExploits0References9
NVD
NVD
added 2026/09/03 5:17 p.m.10 views

CVE-2026-85306

Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5...

6.5CVSS0.0019EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/03 5:17 p.m.11 views

CVE-2026-84779

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents = 1.51.0 versions...

8.1CVSS0.00264EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/03 4:53 p.m.36 views

CVE-2026-85306 WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.5 - Broken Access Control vulnerability

Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5...

6.5CVSS0.0019EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/03 4:53 p.m.15 views

CVE-2026-85306

MountDev AI MCP Connector for WordPress , a plugin by Cascadia Web Services, is affected by a Missing Authorization (Broken Access Control) vulnerability in versions from unspecified up to 1.6.5 . The flaw allows exploitation of incorrectly configured access control security levels, granting a lo...

6.5CVSS5.9AI score0.0019EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/03 4:53 p.m.10 views

EUVD-2026-70556

Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from n/a through 1.6.5...

6.5CVSS5.9AI score0.0019EPSS
SaveExploits0References1
Patchstack
Patchstack
added 2026/09/03 4:47 p.m.7 views

WordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Ananda Dhakal Patchstack in WordPress Plugin MountDev AI MCP Connector for WordPress versions = 1.6.5...

6.5CVSS5.9AI score0.0019EPSS
SaveExploits0Affected Software1
Cvelist
Cvelist
added 2026/09/03 4:31 p.m.53 views

CVE-2026-84779 WordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control vulnerability

Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents = 1.51.0 versions...

8.1CVSS0.00264EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/03 2:49 p.m.20 views

EUVD-2026-58728

CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning...

6.5CVSS5.9AI score0.00137EPSS
SaveExploits0References4
EUVD
EUVD
added 2026/09/03 2:49 p.m.19 views

EUVD-2026-58724

CKAN MCP Server: Information disclosure via verbose error reflection...

3.7CVSS5.9AI score0.00223EPSS
SaveExploits0References4
RedhatCVE
RedhatCVE
added 2026/09/03 10:46 a.m.8 views

CVE-2026-81092

A flaw was found in mcp-go. This component failed to validate the Host header in HTTP requests, specifically within its StreamableHTTPServer and SSEServer transports. A remote attacker could exploit this by using a crafted web page to perform a DNS rebinding attack. This allows the attacker to...

7.6CVSS5.9AI score0.00165EPSS
SaveExploits0References7
Kitploit
Kitploit
added 2026/09/03 6:06 a.m.12 views

agent-scan v0.6.1

Snyk Agent Scan Discover and scan agent components on your machine for prompt injections and vulnerabilities including agents, MCP servers, skills. Note: CLI output is experimental and subject to change Agent Scan v0.5.x planned for deprecation The raw output of this CLI — including issue codes,...

6AI score
SaveExploits0References34
Rows per page
Query Builder