CVE Vulnerability Catalog

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views are declared with a permission class that admits any caller, and the permission check does not halt execution. An unauthenticated request can receive rows and fields from the data source, and identifiers are small integers that can be enumerated. Version 2.3.1 passes raise_exception to the same call.

The Dash MCP server bound its listener to the loopback address but never checked the host a request named. src/mcp_server_dash.py constructed the server for its network mode with the interface restricted to loopback and no transport-security settings, so a name that had been pointed at the loopback address still reached the listener while carrying the attacker's host name. A page in a visitor's browser could therefore drive the local server and invoke its company-search and file-detail tools under the Dropbox credential the server holds. Only the network mode was reachable this way; the standard input mode was not. The fix supplies transport-security settings that enable host checking and allow only the loopback name and port, rejecting other hosts before a tool runs. The repository publishes no versions, so the affected boundary is the commit preceding the fix.

The configure command accepted any endpoint URL and stored it beside the user's access token. ConfigureCommand.execute in src/cli.ts persisted the value given to its endpoint option into the user profile without passing it through createSafeUrl in src/config.ts, the helper that already restricted the environment-variable form of the same setting to the vendor's own hosts over HTTPS. Because the connect path in src/mcp.ts attaches the stored token as a bearer credential on every request to the configured endpoint, a user who was persuaded to run configure with an endpoint of the attacker's choosing sent their personal access token to that destination on each subsequent invocation. Version 0.2.5 applies the same helper to the option.

tiger-gh-mcp-server started its MCP HTTP transport without enabling the host allow-list the underlying SDK provides. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted a request whatever host it named, making the locally reachable GitHub MCP endpoint drivable from a page in a visitor's browser that pointed a name it controlled at the bound address. The fix passes the option explicitly alongside a dependency update; the update alone would not have closed it. The repository has published no release that brackets the fix, so the affected boundary is the commit preceding it.

tiger-slack started its MCP HTTP transport without enabling the host allow-list provided by the underlying SDK. mcp/src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted requests regardless of the host name. A page in a browser could point a controlled name at the server's bound address and drive the locally reachable Slack MCP server through the visitor's browser. The fix passes the option explicitly alongside a dependency update; the update alone would not have closed it.

The Telnyx MCP server exposed its HTTP transport on every interface and did not require a caller credential. Requests without credentials could initialize and dispatch tools, forwarding the server's stored credentials (Telnyx API key, client secret, code-execution key) to the upstream endpoint. The current code defaults to loopback, requires a server API key, and enforces it in middleware.

The execute_ruby tool is documented as a read-only Ruby sandbox, but its denylist does not cover the spawn entry points of the pseudo-terminal library. A normal tool call could start a shell and execute commands as the server account. Version 1.6.1 restricts allowed requires and blocks dynamic dispatch, and 2.0.0 removes the tool.

ToolUniverse ran caller-supplied Python inside an escapable sandbox on a server with no authentication. The executor left attribute-lookup builtins available and did not block dunder attributes reached via string lookup or permitted modules, allowing escape to process and subprocess modules. HTTP and MCP servers bound to all interfaces with debugging enabled and no authentication, so any caller could execute code as the server process. Version 1.3.0 adds bearer-token authentication, defaults to loopback, and hardens attribute checks.

pg-aiguide started its MCP HTTP transport without enabling the host allow-list provided by the underlying SDK. src/httpServer.ts called the shared httpServerFactory helper and never set the DNS-rebinding-protection option, so the transport accepted requests regardless of the host name. A page in a browser could point a controlled name at the server's address and drive the locally reachable MCP server through the visitor's browser. The protection was already available in the packaged transport and simply not turned on, so updating the dependency alone would not have closed it. Version 0.5.1 passes the option explicitly.

The mcp-router CLI served its MCP aggregator on every interface and enforced authentication only when the operator asked for it. A default invocation exposed the aggregator and every MCP server it fronted to anyone able to reach the port. Release 0.6.3 defaults the host to loopback and refuses to start without a token when the host is not loopback.

The get-html-skeleton tool fetched a URL supplied by the caller after checking only its syntax. The validation did not inspect the host name or the resolved address, so loopback, link-local and private ranges were allowed, including cloud instance metadata addresses. Any caller of the MCP server could read the result of a request to an internal endpoint. Version 0.9.12 removes the tool.

mcp-go accepted requests on its HTTP transports without checking the Host header. StreamableHTTPServer.ServeHTTP in server/streamable_http.go and SSEServer.ServeHTTP in server/sse.go served any request arriving over a loopback connection regardless of the host it named, and the SSE transport's cross-origin default allowed any origin. A page in a browser could point a controlled name at the loopback address and reach a server listening there, invoking tools and reading resources that the server exposed on the assumption that only local software could connect. No release before 0.56.0 validated the header on either transport; 0.56.0 adds server/http_localhost.go, which rejects a loopback-bound request carrying a host that is not a loopback name, and wires it into both transports.

The proxy middleware in mcp-use's inspector forwards requests to a destination named by the caller without inspecting the host. Loopback, link-local and private addresses were accepted, and validation was not reapplied to redirects. A caller could make the server issue requests to addresses reachable only from the host and read the responses. The current code calls isSafeProxyTarget, which checks addresses before proxying and bounds redirects.

In the resolv gem before version 0.7.2 for Ruby, during decoding of DNS responses, a new class is generated for each unknown record (type, class) pair or SvcParamKey, and permanently registered as a constant and in hashes, causing unbounded memory growth. An attacker controlling DNS responses can send a response with thousands of unknown types, causing permanent process memory growth that is not reclaimed by GC.

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and update_user_password(), admin/change_current_user_password.php does the same when a user changes their own password, the forgotten-password path in includes/current_user.inc hashes the newly generated password the same way, and authentication calls get_user_auth($loginname, md5($password)). The codebase applies no per-password salt and contains no call to password_hash(), password_verify() or any other adaptive hash, so identical passwords yield identical digests and an attacker who obtains the user table can recover plaintext passwords with precomputed lookup tables or high-rate GPU cracking.

FrontAccounting through 2.4.20 generates a CSRF token in end_form() in includes/ui/ui_controls.inc and embeds it as the _token hidden field in every form it renders, but only admin/users.php and admin/change_current_user_password.php call check_csrf_token() to validate it. No financial transaction handler validates the token, including gl/gl_journal.php, gl/gl_bank.php, purchasing/supplier_invoice.php, sales/customer_invoice.php, sales/customer_payments.php and admin/company_preferences.php, so those endpoints act on POST data with no origin check. An attacker who gets an authenticated user to load a page under attacker control can auto-submit a cross-origin form to any of them and have the forged journal entry, invoice, customer payment, bank transaction or company configuration change recorded under the victim's session.

Vulnerability in Fonoster up to 0.22.7 allows an authenticated user to rename any workspace. The updateWorkspace handler does not stop execution after reporting lack of membership, and access control does not cover this operation.

APITable through 1.13.0-beta.1 annotates both getUserHistories and closePausedUserAccount with requiredLogin = false. ResourceInterceptor honors that annotation by returning before any session or API key is validated, and the nginx gateway proxies every /api request to the backend. An unauthenticated attacker can enumerate accounts in the cooling-off period and close them, deleting account data and preventing recovery.

Vulnerability in APITable up to 1.13.0-beta.1 allows an unauthenticated attacker to create notifications in the system. Missing required login for the create handler of InternalNotifyController and nginx proxy allow access to the API.

The Twig sandbox mechanism in Craft CMS is configured to allow dangerous functionality from the Yii framework, leading to authenticated RCE similar to previously disclosed vulnerabilities.