Threat database

CVE-2026-81491 is a path traversal vulnerability in boxpositron with-context-mcp affecting versions 3.0.0 through 3.0.7. The flaw exists in the ingest_notes, teleport_notes, sync_notes, and project_folder functions within src/index.ts. This vulnerability can be exploited remotely without authentication. Although an exploit has been published, the vendor has not yet responded or issued a fix.