Browse All

The `create_dynatrace_notebook` tool in @dynatrace-oss/dynatrace-mcp-server is missing a human-approval gate that should require operator consent before executing. Unlike five other write tools in the same library, this tool allows anyone to create persistent notebooks with arbitrary content (including embedded DQL queries that execute under other users' permissions) without any confirmation from the system operator.

Open WebUI had a caching bug in its model-list endpoints where the `@cached` decorator used `key=` instead of `key_builder=`, causing all users to share a single cache entry instead of each having their own permission-filtered list. This meant one user could briefly see another user's accessible models if they made a request within the 1-second cache window after that user.

Open WebUI's Socket.IO server accepts unauthenticated WebSocket connections and has two collaborative document handlers (`ydoc:awareness:update` and `ydoc:document:leave`) that lack authentication checks. This allows an attacker without login credentials to spoof user presence, fake cursor positions, and broadcast false events to legitimate users editing documents together.

A vulnerability in the Ansible Lightspeed extension for Visual Studio Code allows attackers with access to a user's computer or malware running on it to steal the Google Gemini API key (a credential that grants access to AI services). The extension stores this key in plain text (unencrypted, readable format) in the user's configuration file and writes it to log files, potentially letting attackers use the user's API quota.

LiteLLM is a proxy server (an intermediary that forwards requests to AI language model APIs) that had a security flaw in versions before 1.83.10-stable. The /health/test_connection endpoint (a tool used to check if model connections work) allowed privileged users to read files from the server's local filesystem by supplying specially crafted references, which is a file disclosure vulnerability (CWE-73, external control of file name or path).

A vulnerability (CVE-2026-14742) was found in langchain-ai langgraph up to version 1.2.4, where the _freeze function in the Task Result Cache (a system that stores computed task results to avoid recalculating them) uses a weak hash when processing the default_cache_key argument. This could potentially be exploited remotely, though the attack requires significant technical skill and is considered difficult to execute.

Microsoft fixed a bug where Copilot buttons were disappearing from Classic Outlook for Windows users with the Copilot Chat (Basic) license. The affected users could not see Copilot in various locations within the email client, though the feature remained available through other access points like Outlook on the web.

oras-go (a tool for working with container registries) didn't validate where it sent credential requests when a registry gave it a new URL in its response. This allowed a malicious registry to trick the tool into either sending credentials over unencrypted connections (defeating HTTPS security) or probing internal network endpoints like cloud metadata services (SSRF, or server-side request forgery, where a program makes requests to places the user didn't intend).

The OpenZeppelin Contracts Wizard had a vulnerability where line breaks in the securityContact and license fields could escape from comments and inject arbitrary code into generated smart contracts (code written in Solidity, Cairo, and other blockchain languages). This only affects cases where untrusted input fills these fields, such as when an AI agent processes external content and passes it to the Wizard.

Pi Agent, a coding assistant tool, had a security weakness in how it exports chat sessions to HTML files. Attackers could hide malicious links in Markdown (a text formatting system) by using special control characters that browsers would ignore, allowing XSS (cross-site scripting, where malicious code runs in a webpage) to execute in the exported HTML file if a user clicked the link. The attack requires multiple steps: an attacker must inject harmful content into a session, the user must export it as HTML, and the user must click the malicious link.

Nuxt's `<NoScript>` component (a way to display content when JavaScript is disabled) had a security flaw where it wrote user-provided data directly into HTML without escaping, allowing attackers to inject malicious scripts. This vulnerability affected all supported versions of Nuxt that include this component.

Bleach, a library that removes dangerous content from HTML, has a vulnerability where it fails to block disallowed URI schemes (like javascript:) when Unicode characters (special invisible characters above U+00A0) are inserted into them. While modern browsers won't execute these malformed links, the vulnerability breaks Bleach's safety promise, and if downstream systems normalize these Unicode characters, the dangerous links could become executable.

A vulnerability in Omni's CreateSchematic API allows an authenticated Operator (administrator) to perform path traversal (accessing files or endpoints outside the intended directory) on the image-factory server by embedding unsanitized user input into a URL path. An attacker can use sequences like '../' to navigate to unintended endpoints and receive back error messages that may leak sensitive information from the image-factory server.

A weakness was found in thedotmack claude-mem software (up to version 11.0.1) where the computeObservationContentHash function uses weak hash functions (cryptographic methods that are easy to break). The vulnerability can only be exploited by someone with local access to the system, and it requires significant technical skill to carry out an attack.

A vulnerability exists in ONNX MLIR (a tool that converts machine learning models to code) versions up to 0.5.0.0 where the generate_hash_key function uses a weak hash (a simple algorithm for converting data into a fixed-length code that is easy to reverse or predict). The vulnerability requires local access to exploit and is difficult to execute in practice.

Streamlit versions up to 1.53.0 contain a vulnerability in the hashing function (a process that converts data into a fixed-size code for security purposes) within its caching system that uses weak cryptographic methods. The vulnerability is difficult to exploit as it requires local access (being on the same computer) and high technical complexity, though it has been disclosed publicly.

MLflow versions up to 3.10.0 contain a vulnerability in the dataset digest computation function that uses weak cryptographic hashing (a mathematical function that converts data into a fixed-size code, but this version uses an insecure version). The flaw requires local access to exploit and is difficult to execute, but a working exploit has been published.

OpenTelemetry Go's `ParseFile` function has a file descriptor leak (a reference to an open file that is never closed), where each call to parse a schema file leaves the file open in memory. In a long-running application that repeatedly parses schema files, these open files can accumulate until the process runs out of available file descriptors and crashes, causing a denial of service (unavailability).

Pterodactyl's Client API has a race condition (a security flaw where multiple requests happening simultaneously interfere with each other) that allows users to create more databases than their assigned limit. The vulnerability exists because the database locking mechanism in the code calls a Laravel function that doesn't actually lock anything, since it's missing a required terminal method like count() or get().