EUVD-2026-5335

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless...

CVE-2026-25536 @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2127 more potentially affected by CVE-2026-25536 via @modelcontextprotocol/sdk (>=1.10.0, <=1.25.3)

@modelcontextprotocol/sdk NPM version =1.10.0, =0.3.3, =1.0.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.0.1, =0.0.1, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =10.1.0-rc.1, =10.2.1 and more Source cves: CVE-2026-25536 Source advisory: SNYK:JS-MODELCONTEXTPROTOCOLSDK-15208843...

Race Condition

Overview @modelcontextprotocol/sdk is a Model Context Protocol implementation for TypeScript Affected versions of this package are vulnerable to Race Condition via the reuse of a single McpServer or Server instance and transport across multiple concurrent client connections. An attacker can acces...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2127 more potentially affected by CVE-2026-25536 via @modelcontextprotocol/sdk (>=1.10.0, <=1.25.3)

@modelcontextprotocol/sdk NPM version =1.10.0, =0.3.3, =1.0.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.0.1, =0.0.1, =1.0.0, =1.1.0, =1.0.0, =1.0.0, =10.1.0-rc.1, =10.2.1 and more Source cves: CVE-2026-25536 Source advisory: OSV:GHSA-345P-7CG4-V4C7...

Malicious code in rreact-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 545745c49f65687bb4f76d176081253cf22e6a0400a6ef46167d730b2c6bc5af The package rreact-sdk was found to contain malicious code. Source: ghsa-malware 20062321714f0ca22d7f2eb77967ff272ade6afac544812eaeacd15b918dbc11 Any...

Malicious Package

Overview rreact-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-715 Malicious code in rreact-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 545745c49f65687bb4f76d176081253cf22e6a0400a6ef46167d730b2c6bc5af The package rreact-sdk was found to contain malicious code. Source: ghsa-malware 20062321714f0ca22d7f2eb77967ff272ade6afac544812eaeacd15b918dbc11 Any...

CVE-2026-1778

Amazon SageMaker Python SDK before v3.1.1 or v2.256.0 disables TLS certificate verification for HTTPS connections made by the service when a Triton Python model is imported, incorrectly allowing for requests with invalid and self-signed certificates to succeed...

binarium (2.1.3), hunter-open-sdk (>=0.0.20, <=2.0.0-beta.25) potentially affected by CVE-2026-24884 via compressing (2.0.0)

compressing NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on compressing and may be impacted: - binarium 2.1.3 - hunter-open-sdk =0.0.20, =2.0.0-beta.25 Source cves: CVE-2026-24884 Source advisory: SNYK:JS-COMPRESSING-15202444...

binarium (2.1.3), hunter-open-sdk (>=0.0.20, <=2.0.0-beta.25) potentially affected by CVE-2026-24884 via compressing (2.0.0)

compressing NPM version 2.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on compressing and may be impacted: - binarium 2.1.3 - hunter-open-sdk =0.0.20, =2.0.0-beta.25 Source cves: CVE-2026-24884 Source advisory: OSV:GHSA-CC8F-XG8V-72M3...

CVE-2026-1664

Summary An Insecure Direct Object Reference has been found to exist in createHeaderBasedEmailResolver function within the Cloudflare Agents SDK. The issue occurs because the Message-ID and References headers are parsed to derive the target agentName and agentId without proper validation or origin...

CVE-2026-1664 Insecure Direct Object Reference (IDOR) via Header-Based Email Routing

Summary An Insecure Direct Object Reference has been found to exist in createHeaderBasedEmailResolver function within the Cloudflare Agents SDK. The issue occurs because the Message-ID and References headers are parsed to derive the target agentName and agentId without proper validation or origin...

CVE-2026-1664

Summary: CVE-2026-1664 affects Cloudflare Agents SDK prior to 0.3.7, due to an IDOR in header-based email routing. Root cause: createHeaderBasedEmailResolver() parses Message-ID and References to derive target agentName/agentId without cryptographic/origin verification, letting external headers s...

CVE-2026-1664 Insecure Direct Object Reference (IDOR) via Header-Based Email Routing

Summary An Insecure Direct Object Reference has been found to exist in createHeaderBasedEmailResolver function within the Cloudflare Agents SDK. The issue occurs because the Message-ID and References headers are parsed to derive the target agentName and agentId without proper validation or origin...

GHSA-RJRP-M2JW-PV9C SageMaker Python SDK has Exposed HMAC

Summary SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where the HMAC secret key is stored in environment variables and disclosed via the DescribeTrainingJob API has been identified. Impact - Function and Payload...

GHSA-62RC-F4V9-H543 SageMaker Python SDK has Insecure TLS Configuration

Summary SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where SSL certificate verification was globally disabled in the Triton Python backend has been found. Impact Arbitrary Code Execution: Disabling SSL verification...

SageMaker Python SDK has Insecure TLS Configuration

Summary SageMaker Python SDK is an open source library for training and deploying machine learning models on Amazon SageMaker. An issue where SSL certificate verification was globally disabled in the Triton Python backend has been found. Impact Arbitrary Code Execution: Disabling SSL verification...

AZL-76443 CVE-2026-24051 affecting package azl-otel-collector 0.127.0-1

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking Untrusted Search Paths on macOS/Darwin systems. The resource detection code in sdk/resource/hostid.go executes the ioreg system command using a search pat...

AZL-76449 CVE-2026-24051 affecting package cri-o 1.30.1-1

OpenTelemetry-Go is the Go implementation of OpenTelemetry. The OpenTelemetry Go SDK in version v1.20.0-1.39.0 is vulnerable to Path Hijacking Untrusted Search Paths on macOS/Darwin systems. The resource detection code in sdk/resource/hostid.go executes the ioreg system command using a search pat...