32 matches found
CVE-2026-81529
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is...
CVE-2026-81529 Connection-option injection via unescaped settings in the canonical MongoDB URL builder
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is...
CVE-2026-81529 Connection-option injection via unescaped settings in the canonical MongoDB URL builder
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is...
CVE-2026-81529
This HIGH severity (CVSS 3.1: 7.1) vulnerability affects the MongoDB C# Driver (NuGet: MongoDB.Driver). The root cause is improper neutralization of delimiters in the connection-URL builder: when untrusted text is passed into the builder and the result is round-tripped back into a client configur...
EUVD-2026-67213
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is...
CVE-2026-81529
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is...
Connection-option injection via unescaped settings in the canonical MongoDB URL builder
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is...
PT-2026-82743
Name of the Vulnerable Software and Affected Versions MongoDB C Driver affected versions not specified Description Improper neutralization of delimiters during connection-URL construction enables connection-option injection. This occurs when an application passes untrusted text into the driver's...
CVE-2026-81529: Improper Neutralization of Argument Delimiters in a Command
Improper neutralization of delimiters in connection-URL construction allows connection-option injection in the MongoDB C Driver. When an application passes untrusted text into the driver's connection-URL builder and round-trips the builder back into a client configuration, the untrusted text is...
CVE-2026-11720
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
EUVD-2026-40146
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
CVE-2026-11720 Path Traversal in googleapis/mcp-toolbox HTTP Tool URL Builder
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
CVE-2026-11720
The CVE-2026-11720 entry describes a path traversal flaw in the HTTP tool URL builder of googleapis/mcp-toolbox. User-controlled pathParams are substituted into a configured tool path and then parsed as a relative URL; while scheme/host/user info are checked, final resolution uses ResolveReferenc...
CVE-2026-11720: Improper Limitation of a Pathname to a Restricted Directory
A path traversal vulnerability exists in the HTTP tool URL builder of googleapis/mcp-toolbox. When constructing downstream API requests, the URL builder substitutes user-controlled pathParams into the configured tool path and parses the resulting string as a relative URL. While it checks that the...
PT-2026-53652
Name of the Vulnerable Software and Affected Versions googleapis/mcp-toolbox affected versions not specified Description A path traversal issue exists in the HTTP tool URL builder. When constructing downstream API requests, the tool substitutes user-controlled pathParams into the configured tool...
Malicious code in argos-findability-url-builder (npm)
The package argos-findability-url-builder was found to contain malicious code...