26 matches found
Linux Distros Unpatched Vulnerability : CVE-2026-111767
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental...
CVE-2026-111767
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel ea...
CVE-2026-111767 MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel ea...
CVE-2026-111767 MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel ea...
CVE-2026-111767
MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature taskStore did not check which session created a task. Clients sharing one InMemoryTaskStore could list, read and cancel ea...
CVE-2026-111767
The MCP TypeScript SDK (@modelcontextprotocol/sdk) versions 1.24.0 through 1.31.0 are vulnerable due to a flaw in the experimental taskStore feature. The root cause is that tasks were not tied to specific sessions, allowing clients sharing a single InMemoryTaskStore to unauthorizedly list, read, ...
CVE-2026-64262
In the Linux kernel, the following vulnerability has been resolved: fuse-uring: end fusereq on io-uring cancel task work When iouring delivers task work with tw.cancel set PFEXITING, PFKTHREAD fallback, or percpurefisdying on the ring context, fuseuringsendintask takes the cancel branch, assigns...
PYSEC-2026-3481 MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
Summary In affected versions, the default request handlers installed by the experimental tasks feature server.experimental.enabletasks did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and...
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
SummaryIn affected versions, the default request handlers installed by the experimental tasks feature server.experimental.enabletasks did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and...
CVE-2026-47391 PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculateexpression tool implemented with Python eval. The example also binds to 0.0.0.0. A remote unauthenticated attacker...
CVE-2026-47391 PraisonAI's unauthenticated A2A official example can reach real LLM-driven `eval()` tool execution
PraisonAI is a multi-agent teams system. Prior to version 4.6.40, PraisonAI's first-party A2A server example exposes an unauthenticated A2A JSON-RPC endpoint and registers a calculateexpression tool implemented with Python eval. The example also binds to 0.0.0.0. A remote unauthenticated attacker...
CVE-2026-47391
PraisonAI’s first-party A2A example exposes an unauthenticated /a2a JSON-RPC surface and registers a calculate(expression) tool implemented via Python eval(), bound to 0.0.0.0. A remote attacker can send message/send to a2a, causing the LLM to invoke the unsafe tool and potentially execute arbitr...
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
Summary In affected versions, the default request handlers installed by the experimental tasks feature server.experimental.enabletasks did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and...
PT-2026-60666
Summary In affected versions, the default request handlers installed by the experimental tasks feature server.experimental.enable tasks did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and...
CVE-2026-52870
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enabletasks for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recordin...
CVE-2026-52870 MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enabletasks for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recordin...
CVE-2026-52870
The MCP Python SDK (package mcp on PyPI) has a vulnerability in versions 1.23.0–1.27.1 where default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel only operate on task identifiers and do not record the session that created each ...
Linux Kernel Security Vulnerabilities
The Linux kernel is the core of the open-source operating system Linux, developed by the Linux Foundation in the United States. There is a security vulnerability in the Linux kernel, which stems from the failure to cancel the mloscanstartwk task. This vulnerability may lead to queuing after...
CVE-2023-53638 octeon_ep: cancel queued works in probe error path
In the Linux kernel, the following vulnerability has been resolved: octeonep: cancel queued works in probe error path If it fails to get the devices's MAC address, octepprobe exits while leaving the delayed work intrpolltask queued. When the work later runs, it's a use after free. Move the...