Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools
CVE-2026-77339
## Summary A malicious website can use DNS rebinding to control a developer's local process-compose MCP SSE listener wh
#cwe-346
共收录 336 条相关情报。
← 返回所有主题Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listener in src/mcp/server.go accepts browser-origin requests t...
CVE-2026-77339
Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listen
Cocos AI: Intra-handshake attested TLS implementation is vulnerable to session-misbinding attacks for Intel TDX verifier path
CVE-2026-92701
trusted execution environments. In versions up to and including 0.8.2, the intra-handshake attested TLS (aTLS) Intel TDX
Cocos AI: Intra-handshake attested TLS implementation can accept Evidence with nil, empty, or omitted reportData in the AMD SEV-SNP path
CVE-2026-92702
Cocos AI is a confidential computing system for running AI workloads inside trusted execution environments. In versions
Process Compose: Browser DNS rebinding lets websites control local process-compose MCP tools
CVE-2026-77339
Process Compose is a scheduler and orchestrator for non-containerized applications. Prior to 1.120.0, the MCP SSE listen
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Origin header back in the Access-Control-Allow-Origin respon...
CVE-2026-89058
A flaw was found in RESTEasy's CorsFilter, which, when configured to allow all origins ("*"), reflects the request's Ori
Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with...
CVE-2026-12284
Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a m
Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict server-rendered content from accessing local or private netwo...
CVE-2026-75025
Mattermost Desktop App versions <=6.2 6.2.2.0 Fixed an issue where Mattermost Desktop did not sufficiently restrict serv
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience claims of the id_token it accepts. An attacker holding a t...
CVE-2026-86466
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience c
Apache Airflow FAB provider: FAB Authentik provider: id_token issuer/audience not validated
CVE-2026-86466
Apache Airflow FAB provider: the Authentik OAuth path in the FAB auth manager does not validate the issuer or audience c
MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/mysql_mcp_server/s...
CVE-2026-59971
MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2
PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiage...
CVE-2026-57112
PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, Tool
Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management boundary is reachable w...
CVE-2026-50025
Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mous
MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)
CVE-2026-59971
## Summary In SSE/HTTP transport mode, `mysql_mcp_server` constructs `SseServerTransport` without passing `security_set
An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP matching for PMKSA caching via missing validation in the ...
CVE-2026-78807
An issue in wpa_supplicant all versions before v.2.12 allows a local attacker to bypass proper network context and AKMP
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
CVE-2026-58649
Origin validation error in .NET allows an unauthorized attacker to disclose information over a network.
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s during OAuth login. Deployments are affected only when th...
CVE-2026-75156
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s
Apache Airflow FAB provider: FAB Azure AD OAuth: id_token issuer/audience not validated — cross-tenant authentication bypass
CVE-2026-75156
Apache Airflow FAB provider versions 3.7.3 through 3.8.0 do not validate the issuer or audience of Azure AD `id_token`s
undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate interceptor is composed directly onto a Client or Pool. Be...
CVE-2026-85152
undici 8.10.0 omits the destination origin from the cache and request-deduplication keys when the cache or deduplicate i
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the...
CVE-2026-84482
WWBN AVideo through commit 9c39d8c8 contains a cross-site request forgery vulnerability in the get_domain() and isSameDo