CVE Vulnerability Catalog

LiteLLM 1.18.10 contains a remote code execution vulnerability in its MCP server creation functionality. The application allows users to add MCP servers via a JSON configuration specifying arbitrary command and args values, which are executed on the host without validation. This enables attackers to run arbitrary operating system commands.

A remote code execution vulnerability was found in xszyou Fay 4.3.1 in its MCP STDIO server management and command execution handling. A remote attacker can access the publicly exposed MCP management interface and configure an MCP STDIO server with attacker-controlled commands and parameters, resulting in arbitrary command execution on the server.

A Cross-Site Request Forgery (CSRF) vulnerability was found in xxl-job-admin web application version 3.0.0. The lack of CSRF token validation and acceptance of arbitrary HTTP methods in the endpoint allow an attacker to make unauthorized modifications to Glue IDE shell scripts.

An issue in GPT Researcher v3.3.7 allows attackers to execute arbitrary commands on a victim system via user interaction with a crafted HTML page.

In n8n-MCP prior to version 2.56.1, in HTTP mode with multi-tenancy enabled (ENABLE_MULTI_TENANT=true), local workflow version history backups were not isolated per tenant. This allowed an authenticated tenant to read and delete backups of other tenants, including full node definitions, credential references, and authorization headers.

The @nocobase/plugin-notification-in-app-message plugin in NocoBase prior to 2.0.61 contains an SQL injection vulnerability via the GET /api/myInAppChannels:list endpoint. The filter[latestMsgReceiveTimestamp][$lt] parameter is directly inserted into a Sequelize.literal() template without sanitization, allowing an authenticated user to execute malicious PostgreSQL queries, potentially including system commands via COPY ... TO PROGRAM.

A buffer overflow vulnerability in Tenda AC10 v3 (firmware V03.03.16.09) allows attackers to cause a permanent Denial of Service (DoS) or potentially execute remote code via the /cgi-bin/UploadCfg endpoint.

In 9Router versions 0.2.21 through 0.4.44, a hardcoded fallback JWT secret '9router-default-secret-change-me' was used, allowing attackers to forge an auth_token cookie when JWT_SECRET is unset. The issue is fixed in version 0.4.44.

In 9Router versions 0.4.30 through 0.4.37, the middleware in src/proxy.js did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated plugin registration and command execution via the MCP bridge. This vulnerability is fixed in version 0.4.37.

In Cilium prior to versions 1.17.14, 1.18.8, and 1.19.2, when L7 functionality is enabled, the embedded or standalone Envoy instance creates a world-accessible admin.sock on cluster nodes. This allows a local attacker to access Envoy admin endpoints, expose TLS secrets, disrupt cluster traffic, or terminate Envoy.

In DataEase before version 2.10.23, a vulnerability exists in enterprise token handling. The TokenFilter#doFilter() passes X-DE-TOKEN values to TokenUtils.validate(), which only checks token presence and length, then userBOByToken() uses JWT.decode() without signature verification. This allows forged tokens with arbitrary uid and oid values to be accepted when licenseValid=true.

In DataEase prior to version 2.10.23, a vulnerability allows remote code execution (RCE) via Redshift datasource connections. An attacker can load a malicious rsjdbc.ini configuration file from the temporary directory, leading to code execution through reflection during a normal JDBC connection.

On April 29, 2026, malicious versions of npm packages `@cap-js/[email protected]`, `@cap-js/[email protected]`, and `@cap-js/[email protected]` were published. These packages harvested credentials and attempted self-propagation within the victim's environment.

A vulnerability in OpenWrt prior to 25.12.5 allows newline injection into /tmp/odhcpd.leases via the DHCPv6 FQDN option 39 hostname. Lack of escaping enables forged lease lines that are rendered as live HTML on the Active DHCPv6 Leases admin page in LuCI.

Better Auth library before version 1.6.11 has a vulnerability in the @better-auth/sso plugin. The POST /sso/register and POST /sso/update-provider endpoints accept attacker-controlled URLs (oidcConfig.userInfoEndpoint, tokenEndpoint, jwksEndpoint) when skipDiscovery: true is set, store them without origin validation, and fetch them during OIDC callback, allowing non-blind server-side request forgery (SSRF) and potential account linking when trustEmailVerified: true is configured.

Better Auth before version 1.6.11 has a vulnerability in the legacy oidcProvider and mcp plugins where OAuth token endpoints authenticate only possession of a valid refresh_token and client_id, without verifying the client_secret. This allows an attacker with a valid refresh_token to mint access tokens and rotated refresh tokens via /api/auth/oauth2/token or /api/auth/mcp/token.

In FastGPT up to commit 22ebfacbb43311e9b73294040ae0eb87390c6bba, artifacts built from untrusted pull request code in GitHub Actions workflows can be downloaded by privileged workflow_run jobs, allowing an attacker to push controlled Docker images to GHCR and, for documentation previews, deploy with the secret KUBE_CONFIG_CN.

The Pegatron `Tdelo64.sys` driver improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks.

A stored cross-site scripting vulnerability in the RustFS Console allows an attacker to inject malicious HTML content via a .pdf file. When previewed, this content can expose administrator credentials (AccessKeyId, SecretAccessKey, SessionToken). Affects versions 0.1.7 through 0.1.9 and is a regression of CVE-2026-27822.

In Lightpanda before version 0.2.9, fetch() and XMLHttpRequest unconditionally attach session cookies to every HTTP request, ignoring credentials: omit, same-origin, include, and XMLHttpRequest.withCredentials. This allows an attacker-controlled origin in a Lightpanda session to issue authenticated cross-origin requests against a victim origin.