20852 matches found
Universal Tool Calling Protocol 安全漏洞
Universal Tool Calling Protocol is an official Python implementation of the UTCP open-source protocol. Versions prior to 1.1.3 of Universal Tool Calling Protocol contained security vulnerabilities; these vulnerabilities stemmed from the prepareenvironment method passing complete environment...
Flowsint 跨站脚本漏洞
Flowsint is an open-source intelligence visualization tool developed by reconurge. Versions of Flowsint prior to 1.2.3 contained a cross-site scripting vulnerability. This vulnerability stemmed from node descriptions containing arbitrary HTML, allowing remote attackers to create nodes with...
PT-2026-41150
Name of the Vulnerable Software and Affected Versions dbt-mcp version 1.15.1 Description The emit tool called event function within the DefaultUsageTracker class in src/dbt mcp/tracking/tracking.py serializes the entire arguments dictionary of every MCP tool call and transmits it without redactio...
The vulnerability of the data collection tool for Azure Monitor Agents from virtual machines and physical servers arises from improper external management of file names or paths. This allows attackers to escalate their privileges.
The vulnerability of the data collection tool for Azure Monitor Agents, which are associated with virtual machines and physical servers, is related to incorrect external management of file names or paths. Exploiting this vulnerability can allow a malicious actor to increase their privileges...
TencentOS Server 4: golang (TSSA-2026:0278)
The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:0278 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...
Joern 4.0.539
Joern is the bug hunter's workbench. With this tool, you can uncover attack surface, sloppy coding practices, and variants of known vulnerabilities using an interactive code analysis shell. Joern supports C, C++, LLVM bitcode, x86 binaries via Ghidra, JVM bytecode via Soot, and Javascript...
PT-2026-41190
Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.5 Description A missing authorization check in the tool update endpoint "POST /api/v1/tools/id/id/update" allows users to bypass the workspace.tools security boundary. While the tool creation endpoint correctly...
Universal Tool Calling Protocol 代码问题漏洞
Universal Tool Calling Protocol is an official Python implementation of the UTCP open-source protocol. Versions prior to 1.1.3 of Universal Tool Calling Protocol had code vulnerabilities, which stemmed from inconsistent trust boundaries and could lead to man-in-the-middle server request forgery...
PT-2026-41186
Name of the Vulnerable Software and Affected Versions CodeWhale versions prior to 0.8.26 Description The task create tool spawns durable sub-agents that inherit insecure default settings. Specifically, the allow shell variable defaults to true and the auto approve variable defaults to true. When ...
Distribution 安全漏洞
Distribution is an open-source toolset developed by Distribution, used for packaging, transporting, storing, and delivering content. Versions of Distribution prior to 3.1.1 contained security vulnerabilities. These vulnerabilities stemmed from bypassing the storage.delete.enabled: false...
Vulnerability in client (CVE-2026-6477)
PostgreSQL libpq lo functions let server superuser overwrite client stack memory Use of inherently dangerous function PQfn..., resultisint=0, ... in PostgreSQL libpq loexport, loread, lolseek64, and lotell64 functions allows the server superuser to overwrite a client stack buffer with an...
PT-2026-41123
Name of the Vulnerable Software and Affected Versions python-utcp versions prior to 1.1.3 Description The substitute utcp args method in cli communication protocol.py inserts user-controlled tool args values directly into shell command strings without sanitization or escaping. These commands are...
Universal Tool Calling Protocol 操作系统命令注入漏洞
Universal Tool Calling Protocol is an official Python implementation of the UTCP open-source protocol. Versions prior to 1.1.3 of Universal Tool Calling Protocol contained a vulnerability related to operating system command injection. This vulnerability stemmed from the substituteutcpargs method...
PT-2026-41149
Name of the Vulnerable Software and Affected Versions dbt-mcp version 1.15.1 Description The DbtMCP.call tool function in src/dbt mcp/mcp/server.py logs the complete raw arguments dictionary at the INFO level for every tool invocation and at the ERROR level if an exception occurs. No fields are...
PT-2026-40976
Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.2 Description A mass assignment issue exists in the tool update endpoint. This occurs when the server does not restrict which properties a client can modify, allowing user-controlled request bodies to include fiel...
CVE-2026-8500
Web::Passwd (Perl)
CVE-2026-43992
JunoClaw is an agentic AI platform built on Juno Network. Prior to 0.x.y-security-1, every MCP write tool sendtokens, executecontract, instantiatecontract, uploadwasm, ibctransfer, etc. accepted 'mnemonic: string' as an explicit tool-call parameter. The BIP-39 seed was consequently embedded in th...
CVE-2026-44777
A flaw was found in jq, a command line JSON processor. The module loader fails to perform cycle detection when resolving imports. This missing cycle detection allows an attacker who can supply crafted modules with circular dependencies to exhaust the stack memory, causing an application crash,...
