308231 matches found
CVE-2026-49457
erlangquic is a pure Erlang QUIC implementation. Prior to version 1.4.4, the QUIC client did not authenticate the server during the TLS 1.3 handshake. The CertificateVerify signature was not checked, the certificate chain was not validated, and the hostname was not compared against the certificat...
CVE-2026-73844
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a...
CVE-2026-73846
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...
CVE-2026-73845
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckangetmqaquality and ckangetmqaqualitydetails tools in src/tools/quality.ts use isValidMqaServer to validate the serverurl parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host an...
CVE-2026-49826
Concourse is a container-based automation system written in Go. Prior to version 8.2.3, an attacker is able to craft and send a user a URL that will redirect the user from the Concourse web server to any other site. This could be used in a phishing attack to steal user's credentials. This has bee...
CVE-2026-46439
compliance-trestle is a tooling platform for managing compliance as code. Versions prior to 3.12.2 and 4.0.3 have a Server-Side Template Injection SSTI vulnerability exists in the trestle author jinja command. The command recursively evaluates rendered templates, allowing an attacker to achieve...
SUSE CVE-2026-71290
Improper TLS hostname verification vulnerability in Apache HttpComponents Client 5.4 or newer. HostnameVerificationPolicyBUILTIN setting has no effect when used with the async version of HttpClient. An attacker that can intercept and modify traffic between the client and the server can impersonat...
CVE-2026-73846 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...
CVE-2026-73846 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...
CVE-2026-73846
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters, allowing different logical parameter sets used by buildCacheKey to collide an...
CVE-2026-73846
The CVE describes a vulnerability in CKAN MCP Server prior to version 0.4.112 where canonicalizeParams in src/utils/cache.ts serializes request parameters with unescaped ampersand, equals-sign, and vertical-bar delimiters. This causes different logical parameter sets used by buildCacheKey to coll...
EUVD-2026-58727
A remote code execution vulnerability exists in Tenable Security Center's report generation functionality. An authenticated, non-administrative user could exploit this issue by supplying specially crafted input that is later processed unsafely during server-side report rendering, resulting in...
@theia/vsx-registry (>=1.1.0-next.14531578, <=1.69.0), openvsx-server (>=1.59.0, <=1.59.1) potentially affected by CVE-2026-19884 via @theia/plugin-ext-vscode (>=1.1.0-next.a62a6b92, <=1.69.0-next.81)
@theia/plugin-ext-vscode NPM version =1.1.0-next.a62a6b92, =1.1.0-next.14531578, =1.59.0, =1.59.1 Source cves: CVE-2026-19884 Source advisory: SNYK:JS-THEIAPLUGINEXTVSCODE-18855353...
CVE-2026-73845
CKAN MCP Server before v0.4.112 is affected by an allowlist bypass in the isValidMqaServer check within the ckan_get_mqa_quality and ckan_get_mqa_quality_details tools (src/tools/quality.ts). The prefix-only regex for dati.gov.it allows suffix-host and URL-userinfo values to target an attacker-co...
CVE-2026-73845 CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckangetmqaquality and ckangetmqaqualitydetails tools in src/tools/quality.ts use isValidMqaServer to validate the serverurl parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host an...
CVE-2026-73845
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckangetmqaquality and ckangetmqaqualitydetails tools in src/tools/quality.ts use isValidMqaServer to validate the serverurl parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host an...
CVE-2026-73845 CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, the ckangetmqaquality and ckangetmqaqualitydetails tools in src/tools/quality.ts use isValidMqaServer to validate the serverurl parameter with a prefix-only regular expression for dati.gov.it, allowing suffix-host an...
github.com/mark3labs/mcp-go: mcp-go: DNS Rebinding vulnerability due to missing Host header validation
A flaw was found in mcp-go. This component failed to validate the Host header in HTTP requests, specifically within its StreamableHTTPServer and SSEServer transports. A remote attacker could exploit this by using a crafted web page to perform a DNS rebinding attack. This allows the attacker to...
CVE-2026-73844 CKAN MCP Server: Information disclosure via verbose error reflection
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a...
CVE-2026-73844
CKAN MCP Server is a tool for querying CKAN open data portals. Prior to 0.4.112, error paths reflect raw upstream response bodies and internal exception messages back to the caller instead of a sanitized, generic message. When the server is pointed at or redirected/SSRF'd to a host that returns a...