618 matches found
CVE-2025-9611
Microsoft Playwright MCP Server prior to version 0.0.40 is vulnerable due to missing Origin header validation, enabling DNS rebinding attacks that can trigger unauthorized requests to locally running MCP tool endpoints. Affected software: MCP Server versions
CVE-2025-9611 Microsoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header Validation
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended...
@ejazullah/playwright-mcp-server (>=1.0.0, <=1.88.0), @grebyn/toolentry-mcp-server (>=1.0.0, <=1.7.1) +24 more potentially affected by CVE-2025-9611 via @playwright/mcp (>=0.0.5, <=0.0.39)
@playwright/mcp NPM version =0.0.5, =1.0.0, =1.0.0, =1.0.8, =1.0.0, =1.0.1, =1.0.1, =1.0.1, =1.0.0, =1.1.0, =1.3.1 and more Source cves: CVE-2025-9611 Source advisory: MEND:CVE-2025-9611...
CVE-2025-9611: Exposed Dangerous Method or Function
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended...
Microsoft Playwright security vulnerabilities
Microsoft Playwright is an automation framework from Microsoft Corporation USA. A security vulnerability exists in Microsoft Playwright MCP Server versions prior to 0.0.40 that stems from an unvalidated Origin header and could lead to DNS rebinding attacks and unauthorized requests...
PT-2026-6379
Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended...
PT-2026-1558
Name of the Vulnerable Software and Affected Versions Microsoft Playwright MCP Server versions prior to 0.0.40 Description The software does not properly validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and se...
EUVD-2025-177129
Malicious code in playwright-sqlite-neptunology-quasar npm...
EUVD-2025-177134
Malicious code in playwright-asthenosphere-norma-cassini npm...
EUVD-2025-177130
Malicious code in playwright-rimraf-version-coronalmassejection npm...
EUVD-2025-180117
Malicious code in bellatrix-child-process-playwright-geodynamo npm...
EUVD-2025-179834
Malicious code in centauri-leda-playwright-cygnus npm...
EUVD-2025-177353
Malicious code in paleomagnetism-playwright-blackhole-izar npm...
EUVD-2025-176150
Malicious code in subscription-playwright-public-carina npm...
EUVD-2025-179303
Malicious code in development-playwright-stratosphere-parcel npm...
EUVD-2025-177117
Malicious code in pm2-gridsome-playwright-init npm...
EUVD-2025-178860
Malicious code in fork-playwright-joviology-accretion npm...
EUVD-2025-177131
Malicious code in playwright-quasar-tachyon-thuban npm...
MAL-2025-188351 Malicious code in nova-astro-playwright-mira (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8be6aa5807609425f2a33e522f29ae44baadab83adcc49c1bc3035527e455cbd This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...