Credential exposure in the openssl-encrypt pip package (versions ≤ 1.4.8) leaks keyserver bearer tokens in cleartext to stderr when the --debug flag is active. The root cause is a gap in sanitize_argv_for_debug(), which fails to redact the token supplied as a positional argument to the 'keyserver set-token' subcommand, leaving it visible in terminal output, CI/CD build logs, and shell history. Fixed in version 1.4.9; no public exploit identified at time of analysis, but credential exposure is immediately actionable for any attacker with access to affected log sources.
Authentication bypass in the jahlives openssl_encrypt library (versions before 1.4.9) permits remote attackers to craft files containing unencrypted post-quantum cryptography (PQC) private keys in file metadata that the library accepts and decrypts successfully under any supplied password. Because the library never validates whether embedded PQC keys are actually encrypted, an adversary controls the decrypted plaintext output entirely while the library simultaneously produces a false positive integrity verification signal. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog, though the CVSS 4.0 score of 8.7 with a network-reachable, unauthenticated, zero-complexity attack surface makes patching urgent for any deployment processing untrusted encrypted files.
Key derivation function downgrade in openssl-encrypt pip package (versions ≤ 1.4.8) allows an attacker who pre-positions a crafted crypt_settings.json in the victim's process launch directory to silently collapse encryption to a single SHA-256 round, rendering resulting ciphertext trivially brute-forceable offline. A regression at line 84 of crypt_settings.py reassigns CONFIG_FILE from the intended absolute home-directory path to a bare relative filename, causing the legacy Tk GUI's SettingsTab to consume attacker-controlled KDF parameters instead of the user's legitimate settings. No public exploit is identified at time of analysis; vendor-released patch is available as version 1.4.9.
Inadequate PBKDF2-HMAC-SHA256 iteration counts in openssl_encrypt versions before 1.4.9 leave post-quantum cryptography keyfile private keys and dual-encryption file-password verification material vulnerable to offline brute-force attack. The library applies only 100,000 iterations for PQC keyfile wrapping and a critically low 10,000 iterations for file-password verification - far below current NIST SP 800-132 recommendations - enabling attackers who obtain keyfiles or encrypted files to recover wrapping passwords using commodity GPU or ASIC hardware at practical cost. No public exploit has been identified at time of analysis, but the attack is technically straightforward once the prerequisite protected material is acquired, and vendor-released patch 1.4.9 is available.
WatchGuard Dimension's log viewer feature exposes an SQL injection flaw that escalates directly to arbitrary command execution on the host system. An authenticated user holding report administration permissions can send specially crafted requests to the log viewer endpoint, injecting SQL that ultimately invokes OS-level commands running as the Dimension WebUI process account. No public exploit or CISA KEV listing has been identified at time of analysis, but the vulnerability class is well-understood and the vendor itself reported it, indicating confirmed existence.
Unauthenticated data disclosure in Baserow's Application Builder exposes all configured data source records to any caller due to a discarded permission check result. The dispatch and record-name API views accept requests from unauthenticated callers, and the underlying service calls `check_multiple_permissions` without requesting it to raise on denial - the returned denial mapping is silently ignored, allowing execution to proceed and the data source to be dispatched using the integration's own stored credentials. Because data source identifiers are sequential integers, any network-reachable attacker can enumerate all Application Builder data sources and retrieve every row and field they expose. No public exploit has been identified at time of analysis.
Server-Side Request Forgery in Apify actors-mcp-server allows any MCP caller to make the server fetch arbitrary internal URLs, including cloud instance metadata endpoints, exposing IAM credentials. The get-html-skeleton tool's URL validation in src/tools/common/get_html_skeleton.ts accepted any syntactically valid http/https URL without inspecting the destination hostname or resolved address, permitting requests to loopback, link-local, and RFC 1918 ranges. The CVSS 4.0 score of 8.7 with PR:N reflects unauthenticated exploitation; no public exploit is identified at time of analysis, and the issue is resolved in version 0.9.12 by removing the tool entirely.
Unauthenticated SSRF in mcp-use's inspector proxy middleware allows any network-reachable caller to coerce the server into issuing HTTP requests to loopback, link-local, and RFC-1918 private addresses - including cloud instance metadata endpoints - and read the responses. The root cause was mountMcpProxy accepting attacker-supplied destinations via the X-Target-URL header or __mcp_target parameter without host validation, and failing to revalidate the resolved address after a server-side redirect. The CVSS 4.0 score of 8.7 (AV:N/AC:L/PR:N/UI:N/VC:H) reflects full confidentiality impact exploitable by any unauthenticated network caller; no public exploit is identified at time of analysis, and the vendor has shipped a fix via the isSafeProxyTarget guard.
Remote code execution in Trilium versions prior to 0.104.0 is achievable by exploiting a bypass in the application's Safe Import filter, which fails to mark the shareTemplate relation as dangerous. An attacker distributes a crafted export archive containing a malicious EJS template; when a user imports it and subsequently publishes the note, the public share renderer passes raw EJS content to ejs.render() in the server's Node.js process, executing attacker-controlled JavaScript with full access to the filesystem, network, and Node.js runtime. No public exploit or CISA KEV listing has been identified at time of analysis, but the detailed public advisory significantly lowers the barrier to exploit development.
Broken access control in the Mobile App for WooCommerce WordPress plugin (versions <= 0.4.62, by Weptile) allows unauthenticated remote attackers to bypass authorization checks and access restricted functionality or data within WooCommerce-powered stores. The flaw is classified under CWE-862 (Missing Authorization), meaning the plugin fails to verify whether a requestor has permission before fulfilling sensitive API or endpoint requests. No public exploit code has been identified at time of analysis, though the unauthenticated, network-accessible nature and high confidentiality impact make this a meaningful risk for any store running the affected plugin versions.
Remote code execution in Flowintel's alerts settings update endpoint (versions >= 3.3.0) allows an authenticated high-privileged attacker to inject arbitrary Python statements into the application's live configuration module. The vulnerable endpoint in app/alerts/alerts.py interpolated attacker-supplied configuration keys directly into Python source written to conf/config_module.py, then triggered importlib.reload() - executing injected code in the server process. No public exploit has been identified and the vulnerability is not listed in CISA KEV, but successful exploitation yields full server-side code execution with the privileges of the Flowintel process.
Buffer overflow in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to trigger a denial-of-service condition or potentially execute arbitrary code by submitting specially crafted traffic to the management interface. The root cause is CWE-787 (out-of-bounds write) in the web-based management component, and the CVSS 4.0 vector confirms network reachability with high-privilege authentication as prerequisites. No public exploit code or active exploitation has been identified at time of analysis, though the RCE potential on a network perimeter device elevates the severity beyond what the privilege requirement alone might suggest.
Privilege escalation in Flowintel's administrative user-edit API allows an organization administrator to modify full administrator accounts within their own organization, including resetting passwords, effectively enabling account takeover of a higher-privileged identity. Affected versions are 3.3.0 and above, as confirmed by upstream commit ffe64d1133b7d84909a69661bd5fee607e9ce757 which adds the missing role-hierarchy boundary check. No public exploit has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Namespace injection in the MongoDB PHP Library allows attackers with application-level access to silently redirect database operations to unintended collections or databases by supplying identifiers containing '.' or NUL byte characters. Applications using the MongoDB PHP Library before 2.4.1 or the MongoDB PHP Driver before 1.21.7 that incorporate untrusted text into namespace identifiers are affected, with high confidentiality and integrity risk confirmed by the CVSS 4.0 score of 8.6. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Namespace injection in the MongoDB C++ Driver (all versions prior to r4.5.1) allows low-privileged users of affected multi-tenant applications to redirect database operations to unintended namespaces. The driver fails to validate caller-supplied database and collection name identifiers against '.' and NUL byte characters, enabling an attacker who can influence those identifiers to access or modify another tenant's data. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; a vendor-released patch is available in r4.5.1.
SQL injection in Dolibarr's CSV and XLSX import wizard (all versions before 24.0.0, including the most recent 23.0.4 stable release) allows an authenticated user holding the import permission to inject arbitrary SQL through the unsanitized updatekeys POST parameter. A crafted UNION SELECT payload simultaneously exfiltrates content from any database table the application account can read and hijacks the WHERE clause of the subsequent UPDATE to redirect which row is overwritten; for category link tables the raw filter array is spliced directly into UPDATE statements. No public exploit has been identified at time of analysis, and this CVE does not appear in the CISA KEV catalog.
OS command injection in maquina-app rails-mcp-server versions 1.4.0 through 1.6.0 allows any caller with access to the execute_ruby MCP tool to escape the purported Ruby sandbox and execute arbitrary shell commands as the server process owner. The execute_ruby tool's denylist blocked Kernel#system, exec, and backtick invocations but never covered Ruby's pseudo-terminal library (PTY) entry points - PTY.spawn and PTY.getpty - enabling a caller to require 'pty' and spawn a child process entirely outside the guarded method replacements. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but the bypass path is fully documented in the vendor's public patch PR.
Insecure default file permissions in the openssl_encrypt desktop GUI (jahlives/openssl_encrypt, all versions before 1.4.9) expose decrypted plaintext output files to any unprivileged local user on multi-user systems. Any co-resident local account can read sensitive plaintext written by the GUI without requiring elevated privileges or exploiting any authentication mechanism. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; a vendor-confirmed patch is available at version 1.4.9.
Cleartext private key exposure in openssl-encrypt (pip package by jahlives) versions 1.4.8 and earlier allows any local user to read a stored mTLS client private key from a world-readable SharedPreferences file. The desktop GUI's Settings screen writes the combined certificate and private key PEM directly into a 0644-permissioned file, making it accessible to all local users on the system without elevated privileges. No public exploit or CISA KEV listing exists at time of analysis, but the trivial exploitation path (read a world-readable file) means any local user on an affected host can silently exfiltrate the private key and use it to impersonate the legitimate mTLS client.
SQL Injection in VillaTheme's Suggestion Engine for WooCommerce plugin (versions ≤ 2.0.11) enables contributor-level authenticated WordPress users to inject malicious SQL through the suggestion engine functionality. The CVSS scope-change indicator (S:C) confirms the injection can reach data beyond the plugin's own tables, exposing the broader WordPress MySQL database with high confidentiality impact. No public exploit code or CISA KEV listing has been identified at time of analysis, but the low-complexity, low-privilege attack profile makes this a credible threat on any WordPress/WooCommerce site that permits contributor accounts.
SQL injection in the Like Button Rating WordPress plugin (versions <= 2.6.61) is exploitable by any authenticated Subscriber-level user, requiring no elevated privileges beyond a standard registered account. The CVSS scope change (S:C) indicates the flaw reaches beyond the plugin's own data, exposing high-confidentiality database content - likely including WordPress user records, hashed credentials, and other site-wide table data. No public exploit code or confirmed active exploitation has been identified at time of analysis.
Subscriber-level SQL injection in ACPT (Pro) Custom Post Types Plugin for WordPress versions 2.0.63 and earlier permits any authenticated subscriber to extract sensitive data from the underlying WordPress database. The CVSS 8.5 score with Scope:Changed reflects that the database read extends beyond the plugin's own tables, potentially exposing WordPress user credentials, site options, and other privileged data. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog at time of analysis.
SQL injection in Kadence Shop Kit (WordPress plugin by Liquid Web, LLC) versions 3.0.6 and earlier enables any subscriber-level WordPress user to inject arbitrary SQL into database queries, yielding high-severity confidentiality exposure across the database. The CVSS changed-scope indicator (S:C) signals the injection can surface data beyond the WordPress application boundary, potentially reaching other schemas accessible to the MySQL user. No public exploit code or CISA KEV listing is confirmed at time of analysis, but the low attack complexity and broad availability of subscriber accounts on open-registration WordPress sites elevate practical risk.
WatchGuard Dimension's Web UI administrator passphrase change endpoint lacks CSRF protection, enabling full account takeover of global administrator accounts through a forged cross-origin browser request. An attacker who can deliver a malicious link or page to an actively authenticated global administrator can silently replace that administrator's passphrase with an attacker-controlled value, granting unrestricted access to the Dimension management platform. No public exploit code has been identified and active exploitation has not been confirmed in CISA KEV at time of analysis.
Cross-realm information disclosure in OpenRemote's Notification REST API exposes all tenants' notification history - including full message bodies - to any authenticated tenant administrator on the platform. Any user holding read:admin credentials in one realm can issue a single zero-parameter GET request to retrieve sensitive notification data belonging to every other realm. No public exploit has been identified at time of analysis, but the attack is trivially simple and requires no technical sophistication beyond valid tenant admin credentials.
Path traversal in NLTK through version 3.10.3 allows attackers who control caller-supplied file paths to read or write files outside the boundaries enforced by the pathsec sandbox module. The affected APIs - TransitionParser, AveragedPerceptron, PerceptronTagger, and maxent parameter loading - perform raw file I/O directly on caller-provided paths without routing through pathsec enforcement, undermining the intended access control boundary. The CVSS 4.0 score of 8.3 reflects high confidentiality impact; no public exploit code or CISA KEV listing has been identified at time of analysis.
Format string injection in CodeMeter Runtime before versions 8.41a and 9.10 enables reliable denial-of-service crashes and sensitive process memory disclosure, including stack canary values, via unsanitized logger input. Wibu-Systems' logging component passes externally controlled strings directly as printf-family format arguments, allowing an attacker to inject specifiers such as %x or %s to read stack memory or terminate the process. The vulnerability is trivially exploitable locally via the cmu CLI tool and becomes remotely exploitable without authentication when chained with CVE-2026-81573; no public exploit has been identified at time of analysis.
Use-after-free in cpp-httplib's TLS WebSocket client (versions 0.33.0 through 0.50.0) corrupts process memory during ordinary secure WebSocket teardown, causing denial of service in any application that embeds this header-only C++ library with wss:// connections. The SSL/TLS session object is freed in `WebSocketClient::shutdown_and_close` before the WebSocket close frame is transmitted, but the underlying `SSLSocketStream` retains a raw pointer to the freed session and dereferences it during the close handshake. The defect is reachable through three distinct paths - the client destructor, an explicit `shutdown_and_close` call, and the `connect()` reconnect path - meaning routine connection lifecycle events, not crafted adversarial input, reliably trigger the corruption. No KEV listing or standalone public exploit exists at time of analysis; vendor-released patch version 0.50.1 is available.
Unauthenticated remote process termination in MongoDB Connector for BI (mongosqld) affects deployments explicitly configured with Kerberos authentication. An attacker with network access to the mongosqld listener can send a crafted GSSAPI authentication exchange that triggers a double-free condition in error-handling code, crashing the process and interrupting BI availability until restarted. No public exploit code has been identified at time of analysis, and the attack is constrained to the subset of deployments running Kerberos - a non-default configuration.
Unsalted MD5 password hashing in FrontAccounting through 2.4.20 renders every stored credential recoverable in minutes if the database is compromised. All authentication-related code paths - user creation, password updates, self-service password change, forgotten-password reset, and login verification - use raw md5() with no per-user salt, so identical passwords produce identical digests and the entire user table can be cracked en masse with rainbow tables or GPU-accelerated tools. No active exploitation (CISA KEV) has been identified, but the CVSS 4.0 score of 8.2 with VC:H reflects that a single database breach translates directly to full plaintext credential exposure across all accounts.
Spring Integration's reactive message pipeline leaks reply routing and security headers across concurrent users when an IntegrationFlow uses .fluxTransform() with an asynchronous or reordering operator that emits raw payloads, causing one user's replyChannel, correlationId, and security or tenant headers to be applied to another concurrent user's response. Affected versions span the 5.5.x, 6.4.x, 6.5.x, 7.0.x, and 7.1.0 release lines across the core Spring Integration library, as confirmed by VMware via the spring.io security advisory. The CVSS 8.2 score reflects network exploitability with no authentication required and high confidentiality impact; no public exploit has been identified at time of analysis.
Stored cross-site scripting in Spring Authorization Server's DefaultConsentPage allows network-accessible, unauthenticated attackers to inject arbitrary JavaScript into the OAuth2 consent screen presented to legitimate users. Affected versions span 1.4.0-1.4.11 and 1.5.0-1.5.8; the attack payload is embedded in a crafted OAuth2 authorization request, persisted server-side, and executed in the victim's browser when they view the consent dialog. No public exploit has been identified at time of analysis, but the low-complexity injection mechanism combined with a CVSS 8.2 base score and high confidentiality impact makes this an urgent remediation target for any deployment relying on the default consent page.
Unsafe deserialization in Spring for GraphQL 2.0.0-2.0.4 exposes Java applications to potential remote code execution when processing paginated GraphQL queries. The flaw, classified as CWE-502, allows network-accessible, unauthenticated attackers to supply crafted payloads through pagination parameters that are deserialized server-side without adequate type safety. CVSS 8.1 with AC:H reflects that exploitation hinges on the presence of a suitable Java gadget chain on the application classpath; EPSS of 0.44% (36th percentile) and no KEV listing indicate no widespread exploitation has been observed at time of analysis.
Arbitrary local file disclosure and denial-of-service exist in Trilium's automatic image-download feature, affecting all versions prior to 0.104.0. Any authenticated user or valid ETAPI token holder can embed file:// scheme URLs in note img tags to cause the server to read and store arbitrary local files - including sensitive system files accessible to the Trilium process - as retrievable note attachments. The same code path, when directed at an unbounded source such as /dev/zero, triggers uncontrolled memory allocation that crashes the server entirely. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-Site Request Forgery in FluentBooking Pro (WordPress plugin) versions 2.2.4 and earlier allows a remote unauthenticated attacker to perform unauthorized booking management actions by forging requests on behalf of an authenticated administrator or privileged user. The plugin fails to validate CSRF tokens (WordPress nonces) on sensitive endpoints, meaning any state-changing action accessible to a logged-in user can be triggered silently by luring that user to an attacker-controlled page. No public exploit code has been identified at time of analysis, and the flaw is not listed in the CISA KEV catalog.
Arbitrary PHP file overwrite in Veno File Manager 4.4.9 allows an authenticated super administrator to replace any PHP file in the application by exploiting a path traversal flaw in the translations update endpoint. Sending a crafted POST request to /vfm-admin/index.php?section=translations&action=update with a manipulated file path parameter causes the application to write attacker-controlled content to arbitrary PHP files, effectively enabling remote code execution via web shell deployment. A public proof-of-concept repository exists at github.com/jfs-jfs/CVE-2026-37068, though EPSS sits at 0.16% and no active exploitation is confirmed.
Spring for GraphQL's bundled GraphiQL developer IDE loads third-party JavaScript libraries from a public CDN without Subresource Integrity (SRI) verification, allowing any attacker capable of tampering with CDN responses to inject and execute arbitrary JavaScript in any browser that loads the GraphiQL page. All four maintained release lines are affected (1.0.x through 2.0.4), as confirmed by the VMware/Spring security advisory and EUVD-2026-67175. No public exploit code has been identified at time of analysis, and EPSS at 0.11% (2nd percentile) reflects currently minimal exploitation activity.
JdbcMessageStore deserialization allowlist protection in Spring Integration silently fails when the store is configured as a Spring-managed bean, rendering the security control entirely ineffective. Operators who call addAllowedPatterns() to restrict which Java classes can be deserialized from the JDBC message store receive no actual protection - any class remains deserializable despite the configured allowlist - leaving applications exposed to unsafe Java deserialization attacks while operators believe they have hardened the component. Affected across Spring Integration 6.4.x through 7.1.0; no public exploit identified at time of analysis.
Improper access control on the Synergis Softwire installation folder exposes sensitive files to any low-privileged local user on Windows Server deployments and Genetec Streamvault SV-100E and SV-300E all-in-one appliances. The CVSS scope change (S:C) is particularly consequential in this context: Synergis Softwire is a physical access control server, meaning credentials or configuration material extracted from the installation directory could allow an attacker to manipulate physical security decisions or pivot into backend systems. No public exploit has been identified at time of analysis, and Genetec has released remediated versions in the 12.0.2 and 12.2.0 branches.
Heap-based buffer overflow in Adobe Substance 3D Sampler versions 5.1.3 and earlier enables arbitrary code execution at the privilege level of the current user when a crafted file is opened. The vulnerability stems from improper bounds checking during file parsing (CWE-122), allowing a heap memory region to be overwritten with attacker-controlled data. No public exploit code has been identified at time of analysis and the flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, but the file-based delivery vector makes it well-suited to phishing or watering-hole campaigns targeting 3D content creators.
Local privilege escalation in Wibu-Systems CodeMeter Runtime allows a low-privileged local attacker to delete arbitrary files with SYSTEM privileges via an NTFS junction attack, potentially cascading to full system compromise. The cmu.exe utility creates predictable temporary files under C:\CM-Stick without validating NTFS reparse points before performing file operations; because the CodeMeter Runtime service runs as SYSTEM, any redirected file operation executes at the highest privilege level. A detailed public research writeup is available from shelltrail.com, substantially lowering the exploitation barrier; no public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Job deduplication in the cakephp/queue plugin can be bypassed by attackers who control job parameter data, causing legitimate unique jobs to be silently dropped. The flaw affects all applications using `shouldBeUnique = true` on job classes where user-supplied input is passed as job parameters - versions 0.1.10 through 2.3.0. No public exploit identified at time of analysis, and the CVSS score of 3.7 (AV:N/AC:H) reflects that exploitation requires knowledge of the target application's job parameter schema.
Session handle confidentiality in Wibu-Systems CodeMeter Runtime is undermined when the software operates in server mode: versions before 8.41a and 9.10 assign cryptographically weak Session IDs (SIDs) as the sole per-connection authenticator, enabling an attacker with a low-privilege connection to brute-force SID values belonging to concurrent sessions. Successfully guessing a valid SID allows the attacker to recover another client's handle number and read the license information associated with that handle, constituting unauthorized cross-tenant license data disclosure. No public exploit has been identified at time of analysis, but the low attack complexity and network accessibility make this a realistic threat wherever CodeMeter is deployed in server mode.
Grafana Alloy's prometheus.operator.servicemonitors component exposes an arbitrary local file read path that leads to credential theft and potential Kubernetes privilege escalation. Any Kubernetes user with ServiceMonitor create or modify rights in a namespace watched by Alloy can point the bearerTokenFile field at any file accessible to the Alloy process - most critically Alloy's own projected Kubernetes service account token - and receive that file's contents exfiltrated via HTTP Bearer token to an attacker-controlled scrape endpoint. The CVSS 7.7 Scope:Changed rating correctly reflects that successful exploitation transcends the compromised namespace, potentially granting the attacker cluster-level API access commensurate with Alloy's own RBAC permissions. No public exploit has been identified at time of analysis.
Arbitrary file read in the Workeera WordPress plugin (before 1.0.6) allows authenticated users with subscriber-level access to exfiltrate sensitive server files, including wp-config.php and authentication secrets. The plugin's candidate profile submission endpoint neither validates which fields a subscriber may populate nor confines file-serving operations to an approved directory, creating a path-traversal-adjacent disclosure path. No active exploitation has been identified (SSVC exploitation: none; EPSS 0.17%), but successful exploitation can fully compromise WordPress credentials and database connection strings, making the effective risk substantially higher than the low EPSS suggests for sites with open subscriber registration.
CVE-2026-19499 has been reported by Ubuntu but contains no available description, CVSS score, vector, or CWE data at time of analysis. The vulnerability's nature, affected component, and impact are entirely unknown from the provided intelligence. No meaningful characterization of this CVE is possible without additional data from the vendor advisory or NVD.
Unrestricted property key injection via Spring Cloud Commons' writable /actuator/env endpoint allows authenticated administrators to POST arbitrary environment properties with no allow-list enforcement, affecting all currently maintained release lines (3.1.10 and earlier through 5.0.2). With CVSS PR:H and a scope change (S:C), exploitation requires admin-level access to the actuator endpoint but can cascade integrity impacts across the entire Spring application context. No public exploit has been identified at time of analysis, and exploitation is gated on a non-default configuration requiring deliberate enablement of write access to the actuator endpoint.
DNS rebinding in mcp-go before 0.56.0 allows a malicious webpage to bypass localhost isolation and invoke tools or read resources on a victim's locally-running MCP server. Both StreamableHTTPServer and SSEServer accepted loopback connections without validating the Host header, and the SSE transport's permissive default CORS policy removed an additional browser-level barrier. No public exploit has been identified and no CISA KEV listing exists, but the attack is practical for any developer running an affected server while browsing the web.
DNS rebinding in Timescale's tiger-gh-mcp-server allows an attacker-controlled web page to drive the victim's locally-bound GitHub MCP HTTP endpoint by exploiting the server's failure to validate Host headers. The src/httpServer.ts file called the shared httpServerFactory helper without passing the SDK's host allow-list option, meaning the server accepted any Host value - a prerequisite for classic DNS rebinding. An attacker who lures a developer running the server in HTTP mode to visit a malicious page can then invoke arbitrary GitHub MCP tools under the victim's authenticated session, including reading private repositories or issuing write operations. No public exploit has been identified and the vulnerability is not listed in CISA KEV.
DNS rebinding against pg-aiguide's MCP HTTP transport (versions through 0.5.0) allows a remote unauthenticated attacker to access and control the locally-bound MCP server by exploiting the disabled host header allow-list in src/httpServer.ts. The underlying MCP SDK already provided DNS rebinding protection via a host allow-list option, but pg-aiguide's httpServerFactory call never enabled it, meaning every inbound Host header was accepted regardless of origin. No public exploit identified at time of analysis, though DNS rebinding is a well-documented attack class with readily available tooling.