13079 matches found
Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
Description The Model Context Protocol MCP Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using FastMCP with streamable HTTP or SSE transport, and has not configured...
EUVD-2025-200273
Model Context Protocol MCP Python SDK does not enable DNS rebinding protection by default...
EUVD-2025-200274
Model Context Protocol MCP TypeScript SDK does not enable DNS rebinding protection by default...
12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2546 more potentially affected by CVE-2025-66414 via @modelcontextprotocol/sdk (>=1.0.0, <=1.23.1)
@modelcontextprotocol/sdk NPM version =1.0.0, =0.3.3, =1.0.0, =0.1.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.1, =0.0.1, =0.0.2, =1.0.0, =1.0.19 and more Source cves: CVE-2025-66414 Source advisory: OSV:GHSA-W48Q-CV73-MX4W...
12306-adk-mcp (0.3.4), 12306-mcp (>=0.3.3, <=0.3.10) +2546 more potentially affected by CVE-2025-66414 via @modelcontextprotocol/sdk (>=1.0.0, <=1.23.1)
@modelcontextprotocol/sdk NPM version =1.0.0, =0.3.3, =1.0.0, =0.1.0, =1.14.1, =1.0.0, =1.2.1, =0.1.4, =0.0.0-dev-nicolas-fix-publishing-aurora-mcp-1750279939, =0.0.1, =0.0.1, =0.0.2, =1.0.0, =1.0.19 and more Source cves: CVE-2025-66414 Source advisory: SNYK:JS-MODELCONTEXTPROTOCOLSDK-14171914...
Malicious Package
Overview m365-action-sdk is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...
MCP TypeScript SDK 安全漏洞
MCP TypeScript SDK is a Model Context Protocol open source developer toolkit for Model Context Protocol servers and clients. A security vulnerability exists in MCP TypeScript SDK versions prior to 1.24.0 that stems from not enabling DNS rebinding protection by default, which could lead to bypassi...
This Week in Spring - December 2nd, 2025
Hi, Spring fans! Welcome to another installment of This Week in Spring. By mistake, I inadvertently published older content in this installment, then tried to fix it and ended up re-publishing the same content. And, what's worse, I somehow ended up deleting the draft I had written for this...
PT-2025-48747
Name of the Vulnerable Software and Affected Versions mcp versions prior to 1.23.0 Description The mcp Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. If an HTTP-based MCP server is running on localhost without authentication, using FastMCP with streamable...
Model Context Protocol Python SDK 安全漏洞
Model Context Protocol Python SDK is a Model Context Protocol open source development tool for Model Context Protocol servers and clients. A security vulnerability exists in the Model Context Protocol Python SDK prior to version 1.23.0, which stems from the fact that DNS rebinding protection is n...
EUVD-2025-200010
Malicious code in m365-action-sdk npm...
Malicious code in m365-action-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a647b4c1144f1fc77a782dcc21ff359b1eecf83ecf7feaae9c0c2f3949670af The package m365-action-sdk was found to contain malicious code. Source: ghsa-malware 41899b4f5df3e91b3c1d1d83bfada41c83afbe17c90245a5410e87518e4e78f...
MAL-2025-191500 Malicious code in m365-action-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2a647b4c1144f1fc77a782dcc21ff359b1eecf83ecf7feaae9c0c2f3949670af The package m365-action-sdk was found to contain malicious code. Source: ghsa-malware 41899b4f5df3e91b3c1d1d83bfada41c83afbe17c90245a5410e87518e4e78f...
CVE-2025-56400
Cross-Site Request Forgery CSRF vulnerability in the OAuth implementation of the Tuya SDK 6.5.0 for Android and iOS, affects the Tuya Smart and Smartlife mobile applications, as well as other third-party applications that integrate the SDK, allows an attacker to link their own Amazon Alexa accoun...
Malicious code in @voiceflow/sdk-runtime (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94c336d86664e23cb704d71c0c615684279844043450c16ee4bd2e434af95435 The package @voiceflow/sdk-runtime was found to contain malicious code. Source: ghsa-malware...
Malicious code in @voiceflow/api-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3e961a08f55ee9c09ea08f6e26ed609d489927fd347b2015b8c7a3074f6c439 The package @voiceflow/api-sdk was found to contain malicious code. Source: ghsa-malware...
MAL-2025-191370 Malicious code in @voiceflow/sdk-runtime (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 94c336d86664e23cb704d71c0c615684279844043450c16ee4bd2e434af95435 The package @voiceflow/sdk-runtime was found to contain malicious code. Source: ghsa-malware...
Malicious code in @browserbasehq/sdk-functions (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0dcba06b8039c18710f9cd77f877d6f7bcf48e1c0d25d161f404e2a14b689fca The package @browserbasehq/sdk-functions was found to contain malicious code. Source: google-open-source-security...
MAL-2025-191333 Malicious code in @voiceflow/api-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e3e961a08f55ee9c09ea08f6e26ed609d489927fd347b2015b8c7a3074f6c439 The package @voiceflow/api-sdk was found to contain malicious code. Source: ghsa-malware...