CVE-2019-12586

The EAP peer implementation in Espressif ESP-IDF 2.0.0 through 4.0.0 and ESP8266NONOSSDK 2.2.0 through 3.1.0 processes EAP Success messages before any EAP method completion or failure, which allows attackers in radio range to cause a denial of service crash via a crafted message...

CVE-2025-1403

Qiskit SDK 0.45.0 through 1.2.4 could allow a remote attacker to cause a denial of service using a maliciously crafted QPY file containing a malformed symengine serialization stream which can cause a segfault within the symengine library...

CVE-2026-0621

Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service ReDoS vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested...

CVE-2025-50817 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk...

GHSA-XQRQ-4MGF-FF32 vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.11-sdk...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2008 more potentially affected by CVE-2026-0621 via @modelcontextprotocol/sdk (>=1.3.0, <=1.25.1)

@modelcontextprotocol/sdk NPM version =1.3.0, =0.3.3, =1.0.0, =0.1.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.1, =0.0.1, =0.0.2, =1.0.0, =1.0.19 and more Source cves: CVE-2026-0621 Source advisory: SNYK:JS-MODELCONTEXTPROTOCOLSDK-14871802...

12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2008 more potentially affected by CVE-2026-0621 via @modelcontextprotocol/sdk (>=1.3.0, <=1.25.1)

@modelcontextprotocol/sdk NPM version =1.3.0, =0.3.3, =1.0.0, =0.1.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.1, =0.0.1, =0.0.2, =1.0.0, =1.0.19 and more Source cves: CVE-2026-0621 Source advisory: OSV:GHSA-8R9Q-7V3J-JR4G...

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

Impact A ReDoS vulnerability in the UriTemplate class allows attackers to cause denial of service. The partToRegExp function generates a regex pattern with nested quantifiers ^/+?:,^/+ for exploded template variables e.g., /id, ?tags, causing catastrophic backtracking on malicious input. Who is...

CVE-2026-0621

Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service ReDoS vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested...

CVE-2026-0621

CVE-2026-0621 affects Anthropic’s MCP TypeScript SDK up to v1.25.1. The vulnerability is a ReDoS in the UriTemplate class when processing RFC 6570 exploded array patterns, where the generated regex uses nested quantifiers that can backtrack catastrophically. Exploitation requires sending a crafte...

CVE-2026-0621 MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS

Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service ReDoS vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested...

CVE-2026-0621 MCP TypeScript SDK UriTemplate Exploded Array Pattern ReDoS

Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 contain a regular expression denial of service ReDoS vulnerability in the UriTemplate class when processing RFC 6570 exploded array patterns. The dynamically generated regular expression used during URI matching contains nested...

Kimwolf Android Botnet Infects Over 2 Million Devices via Exposed ADB and Proxy Networks

The botnet known as Kimwolf has infected more than 2 million Android devices by tunneling through residential proxy networks, according to findings from Synthient. "Key actors involved in the Kimwolf botnet are observed monetizing the botnet through app installs, selling residential proxy...

Security Bulletin:IBM SDK, Java Technology Edition Quarterly CPU - Oct 2025 - Includes Oracle October 2025 CPU for Rational Software Architect Designer

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition,Versions 8 and Java 17 that are used by Rational Software Architect Designer and Rational Software Architect Designer for Websphere Software. These issues were disclosed as part of the IBM SDK, Java Technology Edition...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation for Multiplatforms

Summary Multiple vulnerabilities in IBM SDK Java Technology Edition, Version 8 used by IBM Tivoli System Automation for Multiplatforms. These issues were disclosed as part of the IBM Java SDK updates in October 2025 Vulnerability Details CVEID:CVE-2025-53066 DESCRIPTION: An unspecified...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM Tivoli System Automation Application Manager (CVE-2025-53066, CVE-2025-53057)

Summary There are multiple vulnerabilities in IBM SDK Java Technology Edition used by IBM Tivoli System Automation Application Manager. Vulnerability Details CVEID:CVE-2025-53066 DESCRIPTION: An unspecified vulnerability in Java SE related to the JAXP component could allow a remote attacker to...

PT-2026-1337

Name of the Vulnerable Software and Affected Versions Anthropic's MCP TypeScript SDK versions up to and including 1.25.1 Description The software contains a regular expression denial of service ReDoS issue within the UriTemplate class when handling RFC 6570 exploded array patterns. The dynamicall...

EUVD-2025-205483

Malicious code in eslint-config-sdk npm...

MAL-2025-192952 Malicious code in eslint-config-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e71714baca3a4619a8482f00c00fbed0efcca855796a70e740d4f53a3f807003 The package eslint-config-sdk was found to contain malicious code. Source: ossf-package-analysis...

Malicious code in eslint-config-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e71714baca3a4619a8482f00c00fbed0efcca855796a70e740d4f53a3f807003 The package eslint-config-sdk was found to contain malicious code. Source: ossf-package-analysis...