PT-2026-126429

Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scan vulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos, brute, or intrusive to nmap --script...