terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
CVE-2026-16498
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-H
#advisory
共收录 23636 条相关情报。
← 返回所有主题terraform-mcp-server vulnerable to cross-user credential inheritance if an MCP session ID is obtained by another user
CVE-2026-16496
The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful t
nebula-mesh: Web UI lacks CSRF tokens on /ui/* mutating endpoints
CVE-2026-47725
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.3, every
terraform-mcp-server vulnerable to server side request forgery leading to token exposure
CVE-2026-14869
The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTT
nebula-mesh: Decrypted CA private key persists in heap after signing
CVE-2026-48025
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.7, intern
PhpSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion
CVE-2026-59933
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 t
PhpSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist
CVE-2026-59931
PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. In versions 4.0.0 through 5.8.0, 3.3.0 t
pytonapi has a Webhook Custom Path Authentication Bypass
CVE-2026-54635
pytonapi is a Python SDK for TONAPI that provides REST API, streaming, and webhook access to the TON blockchain. From 2.
QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding
CVE-2026-54609
QTI Neon is a minimal, game-agnostic, relay-based UDP multiplayer protocol library. In version 1.0.0, the relay's handle
OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host
CVE-2026-54603
OAuth2 is a Ruby wrapper for the OAuth 2.0 and 2.1 authorization frameworks, including OpenID Connect (OIDC). From 0.4.0
OAuth: Cross-origin token-request redirects can expose signed request metadata
CVE-2026-54605
OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth:
sqlite3-ruby has Use-After-Free in SQLite Aggregate Function Callbacks
CVE-2026-54620
sqlite3 provides Ruby bindings for the SQLite3 embedded database. From 2.1.0 to 2.9.4, the callbacks used for SQLite agg
sqlite3-ruby has Use-After-Free When Redefining SQLite Functions with Different Arity
CVE-2026-54619
sqlite3 provides Ruby bindings for the SQLite3 embedded database. In version 2.9.4 and earlier, redefining a SQLite func
Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Header Injection
CVE-2026-67182
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to bypass acce
GoPacket's sFlow ExtendedGatewayFlow decoder: unbounded attacker-controlled allocation (104-byte UDP datagram -> up to 16 GiB make) -> unauthenticated remote DoS
CVE-2026-54332
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the sFlow ExtendedGatewayFlow dec
GoPacket's Diameter AVP decoder: uint32 underflow on vendor header size leads to unbounded ~4 GiB allocation (unauthenticated remote DoS)
CVE-2026-54345
gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes
Rouille 0.3.3 - 3.6.2 HTTP Request Smuggling via proxy Transfer-Encoding Header
CVE-2026-67181
Rouille 0.3.3 through 3.6.2 contains an HTTP request smuggling vulnerability that allows remote attackers to desynchroni
Rouille 0.4.0 - 3.6.2 HTTP Response Splitting via Header Injection
CVE-2026-66746
Rouille 0.4.0 through 3.6.2 contains an HTTP response splitting vulnerability that allows remote attackers to inject arb
Rouille 0.1.6 - 3.6.2 Reachable Assertion DoS via remove_prefix percent-encoding
CVE-2026-66754
Rouille 0.1.6 through 3.6.2 contains a reachable assertion vulnerability in the Request::remove_prefix function that all
tiny-http 0.12.0 HTTP Response Splitting via Header Injection
CVE-2026-66753
tiny-http through 0.12.0 contains an HTTP header injection vulnerability that allows attackers to inject carriage return