CVE-2026-16481: Server-Side Request Forgery (SSRF)

A Server-Side Request Forgery SSRF and credential exfiltration vulnerability exists in the cloud-healthcare-fhir-fetch-page tool of googleapis/mcp-toolbox. The tool takes an unvalidated pageURL parameter from the client and issues an HTTP GET request to it using an authenticated client. The...

atacworks (0.3.3), john-toolbox (>=0.1.0, <=0.3.1) potentially affected by CVE-2026-73415 via jupyterlab (2.1.5)

jupyterlab PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - atacworks 0.3.3 - john-toolbox =0.1.0, =0.3.1 Source cves: CVE-2026-73415 Source advisory: OSV:GHSA-GX64-GJ6P-PC4C...

atacworks (0.3.3), john-toolbox (>=0.1.0, <=0.3.1) potentially affected by CVE-2026-73626 via jupyterlab (2.1.5)

jupyterlab PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - atacworks 0.3.3 - john-toolbox =0.1.0, =0.3.1 Source cves: CVE-2026-73626 Source advisory: OSV:GHSA-WHVH-WF3X-G77J...

microbiome-toolbox (>=0.0.8, <=0.0.11), predictnow-client (>=0.0.1, <=0.0.9) potentially affected by CVE-2026-59890 via setuptools (50.3.0)

setuptools PYPI version 50.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - microbiome-toolbox =0.0.8, =0.0.1, =0.0.9 Source cves: CVE-2026-59890 Source advisory: OSV:GHSA-H35F-9H28-MQ5C...

CVE-2026-15829 SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...

CVE-2026-15829 SQL Injection and Security Boundary Bypass in googleapis/mcp-toolbox

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...

Malicious Package

Overview wmi-toolbox is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...

CVE-2026-15829: Improper Neutralization of Special Elements used in an SQL Command

A SQL injection CWE-89 and security boundary bypass CWE-863 vulnerability exists in the prebuilt BigQuery forecasting tool bigquery-forecast of googleapis/mcp-toolbox. The tool accepts client-controlled parameters datacol, timestampcol, and idcols as plain strings and interpolates them unescaped...

adversarial-robustness-toolbox (1.2.0), aristote-malo (1.9.5) +79 more potentially affected by CVE-2026-59205 via pillow (7.0.0)

pillow PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - adversarial-robustness-toolbox 1.2.0 - aristote-malo 1.9.5 - auto-annotate =1.0.0, =1.0.2, =0.1.0.dev31, =1.0.1, =0.2.3, =0.0.1.25, =0.2.1, =0.0.2,...

adversarial-robustness-toolbox (1.2.0), aristote-malo (1.9.5) +79 more potentially affected by CVE-2026-55798 via pillow (7.0.0)

pillow PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - adversarial-robustness-toolbox 1.2.0 - aristote-malo 1.9.5 - auto-annotate =1.0.0, =1.0.2, =0.1.0.dev31, =1.0.1, =0.2.3, =0.0.1.25, =0.2.1, =0.0.2,...

adversarial-robustness-toolbox (1.2.0), aristote-malo (1.9.5) +79 more potentially affected by CVE-2026-54058 via pillow (7.0.0)

pillow PYPI version 7.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on pillow and may be impacted: - adversarial-robustness-toolbox 1.2.0 - aristote-malo 1.9.5 - auto-annotate =1.0.0, =1.0.2, =0.1.0.dev31, =1.0.1, =0.2.3, =0.0.1.25, =0.2.1, =0.0.2,...

atacworks (0.3.3), john-toolbox (>=0.1.0, <=0.3.1) potentially affected by CVE-2026-42557 via jupyterlab (2.1.5)

jupyterlab PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - atacworks 0.3.3 - john-toolbox =0.1.0, =0.3.1 Source cves: CVE-2026-42557 Source advisory: OSV:PYSEC-2026-2537...

marvin-python-toolbox (0.0.4) potentially affected by CVE-2026-44405 via paramiko (2.1.2)

paramiko PYPI version 2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on paramiko and may be impacted: - marvin-python-toolbox 0.0.4 Source cves: CVE-2026-44405 Source advisory: OSV:PYSEC-2026-2858...

atacworks (0.3.3), john-toolbox (>=0.1.0, <=0.3.1) potentially affected by CVE-2026-40171 via jupyterlab (2.1.5)

jupyterlab PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - atacworks 0.3.3 - john-toolbox =0.1.0, =0.3.1 Source cves: CVE-2026-40171 Source advisory: OSV:PYSEC-2026-2538...

azure-arm-nb-extensions (>=0.0.1, <=0.0.2), cfn-docgen (>=0.0.1, <=0.1.4) +1 more potentially affected by CVE-2026-6357 via pip (20.2.3)

pip PYPI version 20.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - azure-arm-nb-extensions =0.0.1, =0.0.1, =0.0.8, =0.0.11 Source cves: CVE-2026-6357 Source advisory: OSV:PYSEC-2026-2876...

azure-arm-nb-extensions (>=0.0.1, <=0.0.2), cfn-docgen (>=0.0.1, <=0.1.4) +1 more potentially affected by CVE-2026-3219 via pip (20.2.3)

pip PYPI version 20.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on pip and may be impacted: - azure-arm-nb-extensions =0.0.1, =0.0.1, =0.0.8, =0.0.11 Source cves: CVE-2026-3219 Source advisory: OSV:PYSEC-2026-2875...

atacworks (0.3.3), john-toolbox (>=0.1.0, <=0.3.1) potentially affected by CVE-2024-22421 via jupyterlab (2.1.5)

jupyterlab PYPI version 2.1.5 is affected by a known vulnerability. The following packages have a transitive dependency on jupyterlab and may be impacted: - atacworks 0.3.3 - john-toolbox =0.1.0, =0.3.1 Source cves: CVE-2024-22421 Source advisory: OSV:PYSEC-2026-2534...

stoertis_toolbox

No d...

microbiome-toolbox (>=0.0.8, <=0.0.11), predictnow-client (>=0.0.1, <=0.0.9) potentially affected by CVE-2026-59890 via setuptools (50.3.0)

setuptools PYPI version 50.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - microbiome-toolbox =0.0.8, =0.0.1, =0.0.9 Source cves: CVE-2026-59890 Source advisory: OSV:PYSEC-2026-3447...

an-website (>=22.7.23, <=22.8.3), aws-toolbox (0.0.2) +10 more potentially affected by CVE-2026-59890 via setuptools (63.2.0)

setuptools PYPI version 63.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on setuptools and may be impacted: - an-website =22.7.23, =4.0.0, =1.0.6, =1.0.1, =0.13.0, =0.0.3, =0.0.4 - vpc-img-inst 1.0.0b7 Source cves: CVE-2026-59890 Source advisory:...