PT-2026-69303

Name of the Vulnerable Software and Affected Versions lmammino oidc-authorizer version 0.4.0 Description A flaw in the Authorization Header Parsing component allows remote attackers to cause a denial of service. The issue occurs within the parse token from header function located in the src/parse...

PT-2026-69248

Name of the Vulnerable Software and Affected Versions IncomeStreamSurfer roo-code-memory-bank-mcp-server versions up to 9dcb2fb5e6b65a35ac1983885a6d4e5621a0081e Description A path traversal issue exists in the read memory bank file/append memory bank entry component within the src/index.ts file...

CVE-2026-19330: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was determined in angrysky56 advanced-reasoning-mcp 1.0.0. The impacted element is the function createsystemjson/createlibrary to getsystemjson/switchmemorylibrary of the file src/index.ts. This manipulation causes path traversal. The attack requires local access. The project was...

PT-2026-69293

Name of the Vulnerable Software and Affected Versions mifi lossless-cut versions prior to 3.69.1 Description A server-side request forgery issue exists within the Built-in HTTP API Service component, specifically in the src/main/httpServer.ts file. This flaw allows an attacker with local network...

PT-2026-69254

Name of the Vulnerable Software and Affected Versions angrysky56 advanced-reasoning-mcp version 1.0.0 Description A path traversal issue exists in the file src/index.ts within the functions create system json, create library, get system json, and switch memory library. Path traversal is a flaw th...

PT-2026-69252

Name of the Vulnerable Software and Affected Versions andreahaku codex mcp versions up to 1ff521cc6cc57cfe56ddef946c644b8534771390 Description Command injection is possible in the ask MCP Tool component within the file src/codex-process-simple.ts. The issue occurs when the model argument is...

PT-2026-69311

Name of the Vulnerable Software and Affected Versions NocteDefensor LudusMCP version 1.0.24 Description A server-side request forgery exists in the read range config component within the src/tools/rangeConfig.ts file. A remote attacker can trigger this issue by manipulating the Source argument,...

PT-2026-69258

Name of the Vulnerable Software and Affected Versions NightTrek Ollama-mcp versions up to 80cf2e17cfc144963a475b619093a2d13c13dbc9 Description A flaw in the file src/index.ts allows for command injection through the manipulation of the name, modelfile, source, or destination arguments. This issue...

CVE-2026-19368: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in PV-Bhat gemsuite-mcp 1.0.0. Affected by this issue is some unknown functionality of the file src/handlers/unified-gemini.ts of the component geminisearch/geminireason/geminiprocess/geminianalyze. The manipulation of the argument filepath/filepaths results in path...

CVE-2026-19366: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in NocteDefensor LudusMCP up to 1.0.24. Affected is an unknown function of the file src/tools/insertCredsRangeConfig.ts of the component insertcredsrangeconfig. Executing a manipulation of the argument configPath/outputPath can lead to path traversal. The attack is restricte...

CVE-2026-19369: Server-Side Request Forgery (SSRF)

A vulnerability was found in KS-GEN-AI jira-mcp-server 0.2.0. This affects the function axios.get of the file src/index.ts of the component addattachmentfrompublicurl. The manipulation of the argument imageUrl results in server-side request forgery. The attack requires a local approach. The proje...

CVE-2026-19327: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in abracadabra50 claude-sesh 1.0.0. This issue affects the function getEnrichedData/enrichSession of the file src/services/enricher.ts. Executing a manipulation of the argument sessionId can lead to path traversal. The attack needs to be launched locally. This patch is calle...

CVE-2026-19328: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in aktsmm skill-ninja-mcp-server 0.1.0. Impacted is the function getInstalledSkills/installSkill/updateAgentsMd/uninstallSkill of the file src/installer.ts. The manipulation of the argument workspacePath leads to path traversal. The attack needs to be performed...

CVE-2026-19335: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in Jane-xiaoer skill-vision-control up to 1.3.0. This vulnerability affects the function getSkillVersionsDir of the file src/svc/utils/config.ts. Such manipulation of the argument skillName leads to path traversal. The attack can only be performed from a local...

CVE-2026-19336: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability was found in Pimzino spec-workflow-mcp up to 2.2.6. This issue affects the function ApprovalStorage.createApproval of the file src/tools/approvals.ts. Performing a manipulation of the argument categoryName results in path traversal. The attack is only possible with local access...

CVE-2026-19352: Server-Side Request Forgery (SSRF)

A vulnerability was determined in mifi lossless-cut up to 3.69.0. Affected by this issue is some unknown functionality of the file src/main/httpServer.ts of the component Built-in HTTP API Service. Executing a manipulation can lead to server-side request forgery. The attack requires access to the...

CVE-2026-19324: Improper Limitation of a Pathname to a Restricted Directory

A weakness has been identified in HelloGGX shadcn-vue-mcp up to e170e277b94235cde627803277fc8c41103a4d38. Affected by this issue is the function fs.promises.readFile of the file src/server/callback-server.ts. This manipulation of the argument filepath causes path traversal. The attack is restrict...

CVE-2026-19329: Improper Neutralization of Special Elements used in a Command

A vulnerability was found in andreahaku codexmcp up to 1ff521cc6cc57cfe56ddef946c644b8534771390. The affected element is an unknown function of the file src/codex-process-simple.ts of the component ask MCP Tool. The manipulation of the argument model results in command injection. The attack...

CVE-2026-19334: Improper Neutralization of Special Elements used in a Command

A flaw has been found in NightTrek Ollama-mcp up to 80cf2e17cfc144963a475b619093a2d13c13dbc9. This affects an unknown part of the file src/index.ts. This manipulation of the argument name/modelfile/source/destination causes command injection. The attack can only be executed locally. This product ...

PT-2026-69247

Name of the Vulnerable Software and Affected Versions HelloGGX shadcn-vue-mcp versions up to e170e277b94235cde627803277fc8c41103a4d38 Description A path traversal issue exists in the fs.promises.readFile function within the src/server/callback-server.ts file. This occurs when the filepath argumen...