CVE-2017-6913

CVE-2017-6913 This is a vulnerability I found in open-xchange OX App Suite's webmail https://www.open-xchange.com/ a while back. Vulnerability details The webmail was vulnerable to a stored XSS when opening an email, due to the event attributes of the HTML time tag not being properly filtered...

Welcome to the Jungle: What We Found Inside 15,465 Public MCP Servers

In 2024, MCP Model Context Protocol set out to become the USB-C of AI: one standard for connecting models, agents, and IDEs to tools and data. The protocol delivered. Thousands of developers built servers, and enterprises plugged them into agent workflows. The ecosystem around it fell short...

Malicious code in legislative-tomato-ox (npm)

Source: amazon-inspector 2187e43edb5c0591f9edf75e2528a37badeb2eb3e7cad97a73be9c132cd4f0be This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in entitled-coffee-ox (npm)

Source: amazon-inspector 0102affe747c2e886ce1f8b8fa7373f63f3d6a82d406893a51162861a226a7ff This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in corporate-amber-ox (npm)

Source: amazon-inspector f8b5590d65bac50eb32949cca62471a32c40282f80975682c648ba6919fdc3b0 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in charming-black-ox (npm)

Source: amazon-inspector 6e1b860be474be7650a7d67571c57832eac0089742ea32fd20315098f321457a This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in balanced-violet-ox (npm)

Source: amazon-inspector 6388b7ebbeb7c8ba52e991caa3a81cd2f2de88b8ecbbcaec30c1304210668b03 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in angry-coffee-ox (npm)

Source: amazon-inspector 22f46f54cf29bef66e4c892999577a450e75fd68c79129b01bf84b5ea4e72a1b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Dovecot Resource Consumption / Access Control

OX Dovecot has been patched to address uncontrolled resource consumption, use-after-free, out-of-bounds read, improper access control, and improper authentication vulnerabilities...

mcp-stdio-shellguard v0.1.2

Part of theStudioMeyer MCP Stack — Built in Mallorca 🌴 · ⭐ if you use it mcp-stdio-shellguard Defense-in-depth bundle for MCP stdio servers. Wraps childprocess.exec/spawn with allowlist + sandbox + replay-detection, plus an AST audit CLI mcp-shellguard-audit that scans MCP server sources for...

Malicious code in @zalastax/nolb-ox (npm)

The package @zalastax/nolb-ox was found to contain malicious code. --- Credit: OpenSSF source...

OX Appsuite - Cross-Site Scripting Detection

OX App Suite through 7.10.4 allows XSS via the app loading mechanism the PATHINFO to the /appsuite URI. !/usr/bin/env python3 -- coding: utf-8 -- """OX App Suite through 7.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...

Dovecot LMTP Resource Consumption DoS

The vulnerability of the Local Mail Transfer Protocol LMTP used by Dovecot and OX Dovecot Pro mail servers involves an uncontrolled consumption of resources. Exploiting this vulnerability allows a malicious actor to cause service failures...

Dovecot Resource Injection DoS

The vulnerability of Dovecot and OX Dovecot Pro mail servers is related to improper control of resource identifiers “resource injection”. Exploiting this vulnerability can allow a malicious actor to cause service failures...

ManageSieve Mail Server Uncontrolled Resource Consumption DoS

The vulnerability of the Dovecot and OX Dovecot Pro mail server services is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Dovecot OX Dovecot Pro Resource Consumption DoS

The vulnerability of Dovecot and OX Dovecot Pro mail servers is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

ManageSieve Mail Server Uncontrolled Resource Consumption DoS

The vulnerability of the Dovecot and OX Dovecot Pro mail server services is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures...

Exploit for CVE-2026-30623

mcpshield !Python 3.10+https://img.shields.io/badge/python...

OPENSUSE-SU-2026:21277-1 Security update for go-sendxmpp

This update for go-sendxmpp fixes the following issues: Changes in go-sendxmpp: - Update to 0.16.0: Added: Add Ox support to http-upload. Add Ox support for private group chats. Show error cause if joining MUCs failedi requires go-xmpp = v0.3.5. Changed: Fix --ox-delete-nodes. Fix receiving of 1-...

CVE-2026-50744

A bypass to the admin‑only restriction of the XML‑RPC API in Revive Adserver 6.0.7. The API response for the ox.login method returned a session ID cookie in the HTTP headers, and although the method correctly returned an error, the associated session was not invalidated. As a result, the leaked...