Threat database

CVE-2026-117570 is a vulnerability in Vorota-ai nmap-mcp (version 0) where the scan_vulnerabilities tool improperly validates its allowlist of NSE script categories. This flaw allows callers, including MCP clients or prompt-injected agents, to bypass restrictions and run blocked script categories such as exploit, dos, brute, or intrusive against scan targets.

Kali-GPT version 0 contains an OS command injection vulnerability in the execute_tool() function within kali_gpt/tools/mcp_server.py. This flaw allows MCP clients to execute arbitrary OS commands by injecting shell metacharacters into parameters such as target, ports, domain, wordlist, or url. The vulnerability arises because these parameters are passed unsanitized to subprocess.run with shell=True, running with the MCP server user's privileges.

mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by supplying crafted videoPath or outputDir values to the resize-video, extract-audio and get-video-info tools. Attackers can embed $(), backticks or a closing double quote in an existing file or directory name to break out of the child_process.exec command string and execute commands as the MCP server user.

CVE-2026-117567 is an OS command injection vulnerability in esp-mcp (horw project) up to commit 28afddf. It allows attackers to execute arbitrary OS commands by injecting shell metacharacters into parameters used by the MCP tool. The vulnerability arises when attacker-controlled input is passed to asyncio.create_subprocess_shell without proper sanitization, enabling command execution as the MCP server user.

EasyImages2.0 versions up to 2.8.6 have an unauthenticated path traversal vulnerability in several PHP scripts that allows attackers to read files outside the intended upload directory by using directory traversal sequences in certain parameters.

Artalk versions before 2.10.1 have an unauthenticated server-side request forgery (SSRF) vulnerability. This flaw allows remote attackers to submit anonymous comments with a crafted page_key parameter pointing to internal URLs. The server fetches these URLs to retrieve page titles without proper validation beyond scheme checking, exposing internal resources via the public comment list.

nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWT_SECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust, impersonating any user ID or claiming the admin role for full administrative access.

MrDoc versions up to 1.1.1 have a broken access control vulnerability that allows authenticated users to modify document share settings of other users. This occurs because the application does not verify ownership when updating share settings. Attackers can predict share tokens by computing the MD5 hash of the document ID and username, enabling them to re-enable disabled shares or remove access codes, potentially exposing private documents.

rssant versions 1.9.0 through 1.9.1 have an authorization bypass vulnerability allowing unauthenticated attackers to read stories from unpublished feeds via the anonymous publish.story_get endpoint. This occurs because the UnionStory.get_by_feed_offset function ignores the only_publish flag, enabling enumeration of feed IDs and offsets to access private feed stories.

Codefriar sf-mcp versions up to 1.3.2 contain an OS command injection vulnerability. This flaw arises because the escapeValue() function does not properly neutralize shell metacharacters such as backticks and $() substitutions. As a result, crafted Salesforce CLI tool flag values can lead to arbitrary shell command execution with the privileges of the MCP server user. The vulnerability has a high severity score of 8.5 and affects all versions from 0 up to and including 1.3.2. A patch is available, and since this is a cloud service, the vendor manages remediation server-side.

ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows attackers to execute shell commands through unsanitized MCP tool parameters. Attackers can plant instructions in email or SMS content to inject $() or backtick substitutions into parameters like message_id, subject, or query, running commands as the user.

DroidMind versions up to 0.4.0 have a command injection vulnerability that allows attackers to bypass shell command allowlists using command substitution techniques. This enables execution of restricted commands like reboot on connected Android devices via certain Device methods.

An OS command injection vulnerability exists in the ai-sdlc plugin MCP server up to version 0.31.2. This flaw allows attackers with limited privileges to execute arbitrary OS commands by injecting shell metacharacters into the 'repo' argument. The vulnerability arises because the unvalidated 'repo' input is directly interpolated into commands executed via execSync(), specifically 'gh issue view' or 'gh pr view'.

SDL_image versions up to 2.8.12 and 3.4.8 contain a stack out-of-bounds read vulnerability in the IMG_LoadLBM_IO() function. This occurs due to missing validation of the bitplane count when HAM mode is enabled, allowing crafted ILBM files with excessive HAM bitplanes to cause memory disclosure or crashes.

zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes the total header length instead of remaining bytes to compint parsing functions. Attackers can supply a crafted .zck file whose header ends inside a compressed integer, causing reads past the heap header buffer and crashing the application.

CImg versions up to 4.0.6 have a heap out-of-bounds read vulnerability in the _load_bmp() function caused by an integer overflow in calculating the row byte count. This flaw allows an attacker to craft a malicious BMP file with a large header width that causes the byte count to wrap, potentially leading to crashes or disclosure of heap memory into the decoded image.

Admidio versions prior to 5.0.17 have an improper access control vulnerability that allows authenticated users to bypass server-side restrictions on event guest registration. Specifically, attackers can manipulate the additional_guests field to register more guests than allowed, exhausting event capacity and preventing other users from registering.

Umbraco CMS versions before 17.7.2 and 18.2.2 contain an authentication bypass vulnerability via an open redirect flaw. This allows unauthenticated attackers to register attacker-controlled OAuth redirect URIs by manipulating the Host header. Exploitation involves sending signed-in users authorization links with response_mode=form_post to capture authorization codes, which attackers then redeem using HTTP Basic client credentials. Successful exploitation can hijack back-office sessions and execute code through Razor templates.

Check Point Research identified a malware campaign named Yoba that abuses the popularity of AI tools like ChatGPT and Claude by creating fake GitHub projects impersonating AI desktop applications such as GPT-5.6 Sol, GPT-6 Astra, and Claude Opus. These projects host malicious installers containing a dropper and loader that fetch and execute malware. The campaign uses DLL sideloading with legitimate signed binaries to evade detection and employs strong operational security by avoiding traditional command-and-control infrastructure, instead using Telegram, Tor, Catbox, and DNS over HTTPS. The threat actor shows indicators of Russian origin and operates primarily in the UTC-4 timezone. The malicious releases are hosted on GitHub without password protection, leveraging SEO poisoning to appear in top Google search results and lure victims.

This analysis discusses how AI is expanding the attack surface of critical infrastructure managed by state, local, and education (SLED) agencies. Cyber attackers often target under-resourced SLED organizations operating critical infrastructure such as water systems, hospitals, and emergency services. AI adoption by these agencies and adversaries' use of AI automation complicate security efforts. A whole-of-state cybersecurity approach, treating all local entities as a unified defensive perimeter, is recommended to mitigate risks. The report highlights concerns about aging operational technology, limited cyber staff in small communities, and unclear governance responsibilities. Attacks on smaller entities can have cascading effects on larger systems and public safety. Insider threats and excessive access privileges further increase risk. Nearly 90% of state CIOs rate cyberattacks on critical systems as a high concern.