MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not v...

CVE-2026-63118

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Tran

历史摘要 · 未重新核验 · NVD

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth::Consumer#token_request parses the raw Location header of...

CVE-2026-54605

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth:

历史摘要 · 未重新核验 · NVD

OAuth: Cross-origin token-request redirects can expose signed request metadata

CVE-2026-54605

OAuth is a Ruby wrapper for the OAuth 1.0 and 1.0a protocols, providing clients and servers. From 0.5.5 to 1.1.5, OAuth:

历史摘要 · 未重新核验 · OSV.dev

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to...

CVE-2026-57978

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a ne

历史摘要 · 未重新核验 · GitHub Advisory

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to...

CVE-2026-57989

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over

历史摘要 · 未重新核验 · GitHub Advisory

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.

CVE-2026-57989

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over

历史摘要 · 未重新核验 · NVD

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-57978

Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing over a ne

历史摘要 · 未重新核验 · NVD

Auth.js: OAuth state, nonce, and PKCE check cookies are not bound to the provider that created them

## Summary Auth.js stores the OAuth/OIDC anti-CSRF checks (`state`, `nonce`, and the PKCE verifier) in global cookies t

历史摘要 · 未重新核验 · GitHub Advisory

n8n: Cross-Issuer Token Exchange Account Binding via Subject-Only Identity Resolution

CVE-2026-59208

## Impact When an n8n instance is configured with more than one trusted token-exchange issuer, external identities are r

历史摘要 · 未重新核验 · GitHub Advisory

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zone. This issue affects BIND 9 versions 9.11.0 through 9.18...

CVE-2026-13321

The BIND resolver accepts validly-signed NSEC records where the "Next Domain Name" field points outside the signer's zon

历史摘要 · 未重新核验 · NVD

Guzzle: Cookie Disclosure and Injection via IP-Address Domains

CVE-2026-59883

### Impact `CookieJar` does not restrict a cookie scoped to an IP address to the exact host that set it. When a stored

历史摘要 · 未重新核验 · GitHub Advisory

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an empty secret (`process.env['NETWORK_AI_MCP_SECRET'] ?? ''`...

CVE-2026-46701

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an e

历史摘要 · 未重新核验 · NVD

WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp messages. Prior to version 0.2.1, the `whatsapp-bridge` HTTP...

CVE-2026-46555

WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp mes

历史摘要 · 未重新核验 · NVD

WhatsApp MCP: Unauthenticated bridge API allows message sending and arbitrary file exfiltration

CVE-2026-46555

WhatsApp MCP Server is a Model Context Protocol (MCP) server for WhatsApp, enabling Claude to read and send WhatsApp mes

历史摘要 · 未重新核验 · OSV.dev

Network-AI: Unauthenticated Cross-Origin MCP Tool Invocation via Empty Default Secret

CVE-2026-46701

Network-AI is a TypeScript/Node.js multi-agent orchestrator. Prior to version 5.4.5, the MCP SSE server defaults to an e

历史摘要 · 未重新核验 · OSV.dev

@hapi/wreck is an HTTP client utility. Prior to 18.1.2, Wreck strips credential headers including Authorization, Cookie, and Proxy-Authorization before following a cross-origin ...

CVE-2026-48022

@hapi/wreck 是一个 Node.js HTTP 客户端工具库，广泛用于 Web 应用和服务间的 HTTP 通信。在版本 18.1.2 之前，该库存在一个安全漏洞：当跟随跨域重定向（Cross-Origin Redirect）时，虽

历史摘要 · 未重新核验 · NVD

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

CVE-2026-59950

### Summary In affected versions, the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`) ac

历史摘要 · 未重新核验 · GitHub Advisory

An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the origin of a communication channel.

CVE-2023-49899

An unauthenticated remote attacker can execute any command on the affected device due to not correctly verifying the ori

历史摘要 · 未重新核验 · NVD

FiftyOne App server uses wildcard CORS (Access-Control-Allow-Origin: *), enabling cross-origin reads of local server data

CVE-2026-53656

### Impact The FiftyOne App/API server (`fiftyone/server/app.py`) and the `/media` route (`fiftyone/server/routes/media

历史摘要 · 未重新核验 · GitHub Advisory

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server tra...

CVE-2026-59950

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to 1.28.1,

历史摘要 · 未重新核验 · NVD