The RubyGem 'gas-refuel-bridge' version 0.9.1 contains malicious code embedded in its native extension build script. During installation, it decodes and executes a hidden Ruby payload that establishes a persistent reverse shell to a remote server after a delay. The payload includes anti-analysis checks to avoid detection in CI environments or ephemeral systems and activates only on developer-like hosts. The gem's outward appearance is benign, with inert code and misleading documentation serving as a cover. This behavior poses a significant risk of unauthorized remote access on systems where the gem is installed.
The RubyGem 'defi-yield-calculator' version 0.9.1 contains malicious code that executes a hidden payload during installation. This payload establishes a persistent remote shell connection to a hardcoded IP address, allowing an attacker interactive access to the victim's machine. The malicious behavior is concealed by anti-analysis checks to avoid detection in sandboxed or ephemeral environments. The package masquerades as a legitimate DeFi yield calculator but includes deceptive metadata and a native extension trigger solely to execute the malicious code.
The RubyGem package dex-router-abis version 0.9.1 contains malicious code in its extconf.rb script that executes automatically during installation. This script decodes and runs a base64-encoded Ruby payload which, after a delay, opens a reverse shell to a hardcoded remote host. The payload activates only on developer workstations with certain environment indicators and credentials present, allowing attackers interactive shell access with potential exposure of local SSH keys and publishing credentials.
AmoyLab Unla versions up to 0.10.0 contain an authentication bypass vulnerability in the OAuth2 server. This flaw allows unauthenticated attackers to obtain valid access tokens because the resource owner is never authenticated. Attackers can exploit this by registering a client, requesting an authorization code, and exchanging it for a token to access protected resources and injected credentials.
CVE-2026-108864 is an authorization bypass vulnerability in iFlytek Astron Agent versions up to 1.1.2. It allows authenticated applications to resume other applications' paused workflows by supplying their event_id to the POST /workflow/v1/resume endpoint. Attackers can predict Snowflake event IDs to inject resume content into victim workflows and read their continuation output stream, breaking cross-tenant isolation. The vulnerability has a low severity score and affects cloud-hosted services.
Katanemo Plano versions up to 0.4.37 have a missing authentication vulnerability that exposes the Envoy admin interface on port 9901 to unauthenticated network attackers. This allows attackers to access the /config_dump endpoint and read sensitive LLM provider API keys in plaintext from the WASM filter configuration.
APIPark versions up to 1.9.7-beta have an insecure direct object reference vulnerability allowing authenticated users with authorization-view permission to access other applications' API keys by supplying a foreign authorization UUID. This bypasses the HideCredential setting and exposes plaintext API keys via the /api/v1/app/authorization endpoint.
Odoo MCP versions 1.0.0 through 1.3.2 have an information disclosure vulnerability that allows clients to bypass field-level access controls. By invoking the execute_method tool, attackers can read restricted fields unredacted, exposing sensitive data. This vulnerability has a medium severity score of 5.3 and does not require user interaction or elevated privileges beyond limited privileges.
BotSharp versions up to 5.2.0 contain a critical authentication bypass vulnerability due to a hard-coded cryptographic key. This flaw allows unauthenticated remote attackers to forge bearer tokens by using the fixed Jwt:Key found in the WebStarter appsettings.json file. Exploiting this, attackers can impersonate any user, including administrators, on API routes protected by authorization.
mcp-go versions up to 1.2.1 have a denial of service vulnerability in the StreamableHTTPServer.ServeHTTP function. Remote unauthenticated attackers can send oversized POST requests that are fully read into memory before validation, allowing them to exhaust server memory and potentially cause the server to crash or become unresponsive.
Predibase LoRAX versions up to 0.12.1 have a vulnerability where the api_token from POST /generate requests is logged in router logs. This exposes sensitive tokens to anyone with access to these logs or OTLP trace backends. The vulnerability has a medium severity with a CVSS score of 6.8.
Hugging Face Text Embeddings Inference versions up to 1.9.4 have a vulnerability where the configured API key is logged in cleartext due to missing redaction in the router's Args struct. This allows attackers with access to logs, container output, or telemetry data to recover the Bearer token and access protected endpoints.
UnicomAI Wanwu versions up to 0.6.5 contain an authorization bypass vulnerability that allows authenticated users to mint AppKeys tied to other users' MCP servers. This enables attackers to open MCP sessions and invoke server tools using the victim's upstream authentication. The vulnerability has a low CVSS score of 2.3, indicating limited impact and complexity.
UnicomAI Wanwu versions up to 0.6.5 have a missing authorization vulnerability that allows any authenticated user to revoke other users' AppKeys for arbitrary applications via the unpublish endpoint. This flaw enables attackers to delete API keys across organizations, disrupting client access to MCP and OpenAPI services. The vulnerability has a medium severity with a CVSS score of 5.3.
Wanwu versions before 0.6.3 have an insecure direct object reference vulnerability that allows any authenticated user to delete other users' legacy AppKeys by specifying a numeric apiId. This flaw enables attackers to revoke AppKeys across organizations by iterating through sequential key IDs, disrupting MCP and OpenAPI clients until new keys are issued by the owners.
UnicomAI Wanwu versions before 0.6.3 have an insecure direct object reference vulnerability that allows authenticated low-privileged users to delete other tenants' applications by manipulating the appId parameter. This flaw enables attackers to send DELETE requests with guessed sequential assistant IDs to remove victims' applications, workflows, conversations, and related data permanently.
Deep Chat versions from 1.4.7 through 2.5.1 contain a cross-site scripting (XSS) vulnerability. This flaw arises because the RemarkableConfig.createNew function disables link validation, allowing attackers to inject javascript: links via crafted Markdown links. These malicious links can appear in AI responses, addMessage content, or loaded history, leading to script execution when a victim clicks them. The vulnerability has a low CVSS score of 2.1 and requires user interaction to exploit.
phpMyFAQ versions 4.1.0 through 4.1.10 contain a missing authorization vulnerability in the MCP server's faq_search tool. This flaw allows MCP clients to bypass user and group permission checks when performing search queries, enabling unauthorized access to restricted FAQs. The vulnerability arises because the Search::searchDatabase() function does not enforce access controls on the returned FAQ content.
Company Research Agent versions up to 2.2.0 have a server-side request forgery (SSRF) vulnerability in the /generate-pdf endpoint. This flaw allows unauthenticated attackers to inject unescaped ReportLab paragraph markup, including inline img elements, causing the server to make outbound requests to internal or external hosts. The responses from these requests can be leaked in the generated PDFs, enabling attackers to probe network reachability and potentially access internal resources.
CVE-2026-108699 is a high-severity vulnerability in hyper-mcp versions up to 0.8.3 where improper cryptographic signature verification allows attackers to load malicious WebAssembly plugins. The function cosign_verify_args() accepts any signer identity and OIDC issuer by default, enabling attackers with control over a plugin image reference to sign malicious images using free Sigstore keyless certificates. This leads to execution of plugins with host, filesystem, and environment capabilities configured in the target system.