studio

ShipSec Studio Plataforma de Orquestación de Flujos de Trabajo de Seguridad de Código Abierto. ShipSec se encuentra actualmente en desarrollo activo. Estamos optimizando la plataforma para un uso estable en producción y operaciones de seguridad de alto rendimiento. ShipSec Studio proporciona un D...

sandbox-agent

在沙箱中运行编码代理，通过HTTP远程控制它们。 一个在沙箱内运行的服务器。你的应用程序远程连接，控制 Claude Code、Codex、OpenCode、Cursor、Amp 或 Pi —— 流式传输事件、处理权限、管理会话。 文档 — API 参考 — Discord 实验性： Gigacode —— 使用任意编码代理的 OpenCode TUI。 为什么选择 Sandbox Agent？ 远程运行编码代理很困难。现有的 SDK 假定在本地执行，SSH 破坏了 TTY 处理和流式传输，而且每个代理都有不同的 API。从头开始构建意味着要为每个编码代理重新实现一切。 Sandbox...

firecrawl-mcp-server

Firecrawl MCP 服务器 一个模型上下文协议（MCP）服务器，将 Firecrawl 带入兼容 MCP 的 AI 代理——搜索、抓取并与实时网络交互，以获取干净、代理就绪的上下文。 特别感谢 @vrknetha 和 @knacklabs 的初始实现！ 功能特性 搜索网络并获取完整页面内容 将任何 URL 抓取为干净的结构化数据 与页面交互——点击、导航和操作 使用自主代理进行深度研究 自动重试和速率限制 云和自托管支持 SSE 支持 在 MCP.so 的游乐场 或 Klavis AI 上试用我们的 MCP 服务器。 安装 托管 MCP（无密钥免费层）...

pentest-mcp

es-define-property Object.defineProperty, but not IE 8's broken one...

damn-vulnerable-MCP-server

Compatibilidad SSE de Cursor para Damn Vulnerable MCP Este documento proporciona una visión general de las actualizaciones realizadas en el proyecto Damn Vulnerable Model Context Protocol DVMCP para hacerlo compatible con la implementación de Server-Sent Events SSE de Cursor. Resumen El proyecto...

MCP-Inspector-CVE-2025-49596

MCP Inspector CVE-2025-49596 Vulnerability Checker This script checks if an MCP Inspector server is vulnerable to CVE-2025-49596, a security issue where the /sse endpoint responds to unauthenticated requests missing auth token. How It Works The script sends a GET request to the /sse endpoint of t...

CVE-2026-61592

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen sessionid with no binding to the authenticated user — a control the WebSocket transport has but that was dropped...

CVE-2026-61599 djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its...

djust has an unauthenticated arbitrary module import via the WebSocket/SSE view-mount path

Impact The djust live transport resolves the LiveView to mount from a client-supplied dotted path by calling importmodulepath, .... The module is imported — running its top-level code import side effects — before the framework checks that the resolved object is a LiveView subclass and before any...

djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

Impact SSE sessions were keyed solely by a client-chosen sessionid with no binding to the authenticated user — a control the WebSocket transport has but that was dropped on SSE. An attacker who learns or a victim who leaks a sessionid could connect to the message endpoint and dispatch event...

EUVD-2026-81301

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen sessionid with no binding to the authenticated user — a control the WebSocket transport has but that was dropped...

CVE-2026-61592

djust is a reactive server-side rendering library for Django providing Phoenix LiveView-style functionality with Rust-powered performance. Prior to version 1.0.7 , its SSE (Server-Sent Events) transport keyed sessions solely by a client-chosen session_id with no binding to the authenticated user ...

CVE-2026-61592 djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen sessionid with no binding to the authenticated user — a control the WebSocket transport has but that was dropped...

CVE-2026-61592 djust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed solely by a client-chosen sessionid with no binding to the authenticated user — a control the WebSocket transport has but that was dropped...

CVE-2026-34227

Interfaz MCP no autenticada + Bypass de CORS El servidor MCP de Sliver levanta una interfaz SSE no autenticada y responde con Access-Control-Allow-Origin: en cada respuesta. La librería mcp-go no valida el Content-Type, por lo que las Solicitudes Simples text/plain omiten por completo la...

CVE-2026-61593 djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a...

CVE-2026-61593 djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a...

CVE-2026-61593

djust (a Phoenix LiveView-style reactive server-side rendering library for Django with Rust) is vulnerable to Cross-Site Request Forgery (CSRF) on its Server-Sent Events (SSE) transport prior to version 1.0.7 . The root cause: SSE POST endpoints were @csrf_exempt, the SSE GET stream endpoint lack...

djust has Cross-Site Request Forgery on the Server-Sent-Events transport: a cross-origin page can drive a victim-authenticated SSE session

Impact The SSE client→server POST endpoints are @csrfexempt and the SSE GET stream endpoint had no Origin check, so a cross-origin page could drive a victim-cookie-authenticated SSE session: force the victim's browser to GET the stream URL which creates and mounts a LiveView as the victim and POS...

EUVD-2026-80851

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust.tenants isolation was enforced only on the HTTP path. The current tenant was stored in threading.local and set exclusively by the HTTP-only TenantMiddleware...