CVE-2026-101061 is a server-side request forgery (SSRF) vulnerability affecting the universal-tool-calling-protocol python-utcp versions before 1.1.1. The flaw exists because the GraphQL plugin's prefix check can be bypassed with crafted URLs, and the WebSocket plugin lacks URL validation. This allows attackers to make the server connect to internal services or cloud metadata endpoints and potentially exfiltrate sensitive API keys and OAuth tokens. The vulnerability has a low CVSS score of 2.3 and requires user interaction and high attack complexity.
python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follows HTTP redirects without re-validating the target. Attackers controlling a tool endpoint can return a 302 redirect to internal services, allowing the UTCP client to reach cloud metadata endpoints or internal HTTP services and return their response bodies to the caller.
utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints. When a victim registers an attacker-controlled OpenAPI spec and invokes a generated OAuth2-protected tool, the library POSTs the victim's client_id and client_secret to the attacker-supplied token endpoint without URL validation.
CVE-2026-101058 is a Server-Side Request Forgery (SSRF) vulnerability in the python-utcp package (pip package utcp-http) versions before 1.1.12. The flaw allows an attacker who can serve a UTCP manual to a victim to cause the client to send requests to services bound to the victim's loopback interface (127.0.0.1). This occurs because the package does not verify if tool URLs declared in a UTCP manual fetched from a remote origin point to the loopback interface. The vulnerability affects the http, sse, and streamable_http protocols. Exploitation requires a loopback service that responds to unauthenticated requests with useful data. The issue is fixed in version 1.1.12, which rejects manuals fetched from non-loopback origins that declare loopback tool URLs.
CVE-2026-101057 is a vulnerability in the utcp-mcp plugin of python-utcp up to version 1.1.2 where it connects to HTTP and WebSocket MCP server URLs without enforcing secure URL validation. This allows cleartext transmission of the MCP handshake to non-secure HTTP servers, potentially exposing sensitive information to network interception. The vulnerability is limited by the fact that the server URLs are operator-configured and the OAuth2 authentication path is not invoked in affected versions. The issue is fixed in version 1.1.3 by validating server URLs before connection.
mediasoup versions 3.20.0 through 3.20.6 (npm) and 0.22.0 through 0.22.5 (Rust crate) contain an insufficient verification of data authenticity vulnerability in their SCTP stack. The built-in SCTP stack uses hardcoded magic values instead of a per-instance secret and HMAC to authenticate state cookies, allowing an on-path attacker targeting PlainTransport or PipeTransport with SCTP enabled and no DTLS protection to forge a valid COOKIE-ECHO packet. This enables unauthorized SCTP association establishment and DataChannel message injection as a trusted peer. WebRtcTransport is not affected as its SCTP runs inside DTLS. The issue is fixed in npm version 3.20.6 and Rust crate version 0.22.5.
Authentication bypass by primary weakness vulnerability in Universal Software Inc. E-Municipality allows Exploitation of Trusted Identifiers.
This issue affects E-Municipality: from 20251127 before 20260204.
Missing authentication for critical function vulnerability in Universal Software Inc. UKBS allows Accessing Functionality Not Properly Constrained by ACLs.
This issue affects UKBS: through 28072026.
NOTE: The vendor was contacted and it was learned that the product is not supported.
Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incorrectly Configured Access Control Security Levels.
This issue affects FlexCity: from 5.536.0 before 5.542.0.
Improper restriction of excessive authentication attempts vulnerability in Universal Software Inc. FlexCity allows Excessive Allocation.
This issue affects FlexCity: from 5.536.0 before 5.542.0.
URL redirection to untrusted site ('open redirect') vulnerability in Universal Software Inc. FlexCity allows Input Data Manipulation.
This issue affects FlexCity: from 5.536.0 before 5.542.0.
Self Cross-Site Scripting (Self-XSS) vulnerability in the RD Station Conversas chat feature. The vulnerability lies in the ‘name’ parameter of the initialisation process due to incorrect sanitisation of user-supplied input. Exploitation allows specially crafted JavaScript code to be injected, which is executed within the context of the user’s own session who provides the payload. The demonstrated impact is limited to the user who enters and executes the payload.
A vulnerability was detected in universal-tool-calling-protocol python-utcp 1.1.0. This affects an unknown function of the component utcp-gql/utcp-websocket. Performing a manipulation results in server-side request forgery. The attack can be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
typescript-utcp is a typescript implementation of UTCP. Prior to 1.1.2, the @utcp/http package is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation.registerManual() validates the discovery URL against an HTTPS / loopback allowlist, but callTool() reuses the resolved toolCallTemplate.url directly without revalidating, and the OpenApiConverter blindly trusts whatever servers[0].url an attacker-hosted spec declares. An attacker who hosts a malicious OpenAPI spec on a legitimate HTTPS endpoint can declare e.g.servers: [{ url: "http://127.0.0.1:9090" }] or servers: [{ url: "http://169.254.169.254" }]; the converter then produces tools whose URL points at internal services on the agent host. This vulnerability is fixed in 1.1.2.
CVE-2026-45369 is an OS command injection vulnerability in the python-utcp package prior to version 1.1.3. The vulnerability arises because the _substitute_utcp_args method inserts user-controlled input directly into shell command strings without sanitization, which are then executed by the system shell. This allows an attacker to inject arbitrary commands. The vulnerability has a high severity with a CVSS score of 8.3. A fix is available in version 1.1.3.
python-utcp is the python implementation of UTCP. Prior to 1.1.3, _prepare_environment() in cli_communication_protocol.py passes a full copy of os.environ to every CLI subprocess. When combined with CVE-2026-45369, an attacker can exfiltrate all process-level secrets in a single tool call. This vulnerability is fixed in 1.1.3.
python-utcp is the python implementation of UTCP. Prior to 1.1.3, the utcp-http plugin is vulnerable to a blind Server-Side Request Forgery (SSRF) caused by a trust-boundary inconsistency between manual discovery and tool invocation.register_manual() validates the discovery URL against an HTTPS / loopback allowlist, but call_tool() and call_tool_streaming() reuse the resolved tool_call_template.url directly without revalidating, and the OpenAPI converter blindly trusts whatever servers[0].url an attacker-hosted spec declares. An attacker who hosts a malicious OpenAPI spec on a legitimate HTTPS endpoint can declare e.g.servers: [{ url: "http://127.0.0.1:9090" }] or servers: [{ url: "http://169.254.169.254" }]; the OpenAPI converter then produces tools whose URL points at internal services on the agent host. All three HTTP-class protocols (utcp_http.http, utcp_http.streamable_http, utcp_http.sse) shared the same gap. This vulnerability is fixed in 1.1.3.
OS command injection in Dashboard Server interface in Universal Robots PolyScope versions prior to 5.25.1 allows unauthenticated attacker to craft commands that will execute code on the robot's OS.
A weakness has been identified in universal-ctags ctags up to 6.2.1. The affected element is the function parseExpression/parseExprList of the file parsers/v.c of the component V Language Parser. Executing a manipulation can lead to uncontrolled recursion. It is possible to launch the attack on the local host. The exploit has been made available to the public and could be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.
