GHSA-HJWH-XVFW-QRWJ SearXNG Basic Authentication Credentials Exposed Through MCP Logs and JSON-RPC Error Responses

Summary mcp-searxng version 1.11.0 exposes SearXNG Basic Authentication credentials embedded in the SEARXNGURL environment variable. When the server starts in STDIO mode and an MCP client connects, the complete SEARXNGURL, including its username and password, is sent to the client through an MCP...

Mozilla: Content security policy leak in violation reports using iframes

The Mozilla Foundation Security Advisory describes this flaw as: The Content-Security-Policy-Report-Only header could allow an attacker to leak a child iframe's unredacted URI when interaction with that iframe triggers a redirect...