Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
23 results
Oct 11, 2026mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memoryCVE-2026-108859 · Other software · mark3labs · reported by VulnCheckHigh 8.7
mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll before validation, to degrade or OOM-kill the server process.
- Product
- mcp-go
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 27, 2026startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpSerCVE-2026-81735 · Other software · bytedance · reported by VulnCheckCritical 10
startServer.ts in the mcp-http-server package of UI-TARS-desktop defaulted its listen address to '::' when no host was given, so startSseAndStreamableHttpMcpServer bound the Streamable HTTP and SSE MCP transports to every interface, and its authentication middleware was optional: middlewares are applied only when a caller supplies them. The @agent-infra/mcp-server-commands and @agent-infra/mcp-server-filesystem entry points call startSseAndStreamableHttpMcpServer with a host and port alone and pass no middleware, so neither server required a credential. The commands server exposes a run_command tool that hands its caller-supplied command string to promisify(child_process.exec), so any unauthenticated client able to reach the port could run arbitrary commands as the user running the server, and the filesystem server exposed its file read and write tools on the same terms. The listen default became 127.0.0.1 in commit c2ad42e3eb9b27830db41a3e6f51ca7179d9b168; the package version stayed at 1.2.4 across that change, so the boundary is the commit rather than a release.
- Product
- UI-TARS-desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 21, 2026The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not reCVE-2026-59279 · Other software · Spring · reported by security@vmware.comHigh 7.5
The MCP Streamable HTTP server transport (WebFlux and WebMvc variants) does not place any limit on the number of sessions it retains, and by default does not require clients to be authenticated. As a result, a remote attacker can cause the server to accumulate an unbounded number of sessions over time, gradually exhausting available memory and ultimately causing a Denial of Service that affects all legitimate clients. Affected versions: Spring AI: 2.0.0
- Product
- Spring AI
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 13, 2026streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viCVE-2026-73039 · Other software · streamaserver · reported by VulnCheckMedium 5.3
streama contains an insecure direct object reference vulnerability in ViewingStatusController that allows authenticated users to read and delete other users' viewing status records. Attackers can enumerate all users' watch progress, delete arbitrary viewing history, and manipulate other users' Continue Watching dashboards by supplying arbitrary primary keys without ownership verification.
- Product
- streama
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may alCVE-2026-16498 · Other software · HashiCorp · reported by security@hashicorp.comCritical 10
The terraform-mcp-server before version 1.1.0 is vulnerable to a cross-tenant credential reuse issue in the streamable-HTTP stateless transport mode that may allow one user's Terraform token to be used to execute tool calls on behalf of subsequent users. This vulnerability, CVE-2026-16498, is fixed in terraform-mcp-server 1.1.0.
- Product
- Tooling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who CVE-2026-16496 · Other software · HashiCorp · reported by security@hashicorp.comHigh 8.9
The terraform-mcp-server before version 1.1.0 is vulnerable to an authorization bypass in the streamable-HTTP stateful transport mode that may allow a user who obtains another user's MCP session ID to have their tool calls executed using that user's Terraform credentials. This vulnerability, CVE-2026-16496, is fixed in terraform-mcp-server 1.1.0.
- Product
- Tooling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 28, 2026The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthentiCVE-2026-14869 · Other software · HashiCorp · reported by security@hashicorp.comHigh 8.6
The terraform-mcp-server before version 1.1.0 is vulnerable to a server-side request forgery issue in the streamable-HTTP transport that may allow an unauthenticated remote client to redirect the server's Terraform API requests, and the server-side authorization token, to an attacker-controlled endpoint. This vulnerability, CVE-2026-14869, is fixed in terraform-mcp-server 1.1.0.
- Product
- Tooling
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 16, 2026OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers durinCVE-2026-53840 · Other software · OpenClaw · reported by VulnCheckMedium 6
OpenClaw before 2026.5.12 contains an information disclosure vulnerability in streamable-http MCP servers that forwards operator-configured custom headers during cross-origin redirects. Attackers controlling or compromising an MCP endpoint can redirect requests to exfiltrate sensitive headers like API keys or tenant-routing credentials to attacker-controlled origins.
- Product
- OpenClaw
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comvulncheck.com
Mar 27, 2026A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.44.CVE-2026-4956 · Other software · Shenzhen Ruiming Technology · reported by VulDBMedium 5.5
A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.44. The affected element is an unknown function of the file /DevicePrint.do?Action=ReadTask of the component Parameter Handler. The manipulation of the argument State results in sql injection. The attack can be launched remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Streamax Crocus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.44.CVE-2026-4955 · Other software · Shenzhen Ruiming Technology · reported by VulDBMedium 5.5
A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.44. This impacts an unknown function of the file /OperateStatistic.do. The manipulation of the argument VehicleID results in sql injection. The attack can be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Streamax Crocus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 27, 2026A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus up to 1.3.44.CVE-2026-4910 · Other software · Shenzhen Ruiming Technology · reported by VulDBMedium 5.5
A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus up to 1.3.44. Affected is an unknown function of the file /RemoteFormat.do of the component Endpoint. Such manipulation of the argument State leads to sql injection. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Streamax Crocus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 18, 2025Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 contain a combination of path traversal and server-side request forgery (SSRF) vulnerabilitieCVE-2025-34452 · Other software · Streama · reported by VulnCheckHigh 8.7
Streama versions 1.10.0 through 1.10.5 and prior to commit b7c8767 contain a combination of path traversal and server-side request forgery (SSRF) vulnerabilities in that allow an authenticated attacker to write arbitrary files to the server filesystem. The issue exists in the subtitle download functionality, where user-controlled parameters are used to fetch remote content and construct file paths without proper validation. By supplying a crafted subtitle download URL and a path traversal sequence in the file name, an attacker can write files to arbitrary locations on the server, potentially leading to remote code execution.
- Product
- Streama
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordchocapikk.comgithub.com
Oct 17, 2025A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40.CVE-2025-11914 · Other software · Shenzhen Ruiming Technology · reported by VulDBLow 2.1
A vulnerability was found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected by this issue is the function Download of the file /DeviceFileReport.do?Action=Download. Performing manipulation of the argument FilePath results in path traversal. The attack may be initiated remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Streamax Crocus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025A vulnerability has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40.CVE-2025-11913 · Other software · Shenzhen Ruiming Technology · reported by VulDBLow 2.1
A vulnerability has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected by this vulnerability is the function Download of the file /Service.do?Action=Download. Such manipulation of the argument Path leads to path traversal. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Streamax Crocus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025A flaw has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40.CVE-2025-11912 · Other software · Shenzhen Ruiming Technology · reported by VulDBLow 2.1
A flaw has been found in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. Affected is the function Query of the file /DeviceState.do?Action=Query. This manipulation of the argument orderField causes sql injection. The attack can be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Streamax Crocus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40.CVE-2025-11911 · Other software · Shenzhen Ruiming Technology · reported by VulDBLow 2.1
A vulnerability was detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This impacts the function Query of the file /DeviceFault.do?Action=Query. The manipulation of the argument sortField results in sql injection. It is possible to launch the attack remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Streamax Crocus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40.CVE-2025-11910 · Other software · Shenzhen Ruiming Technology · reported by VulDBLow 2.1
A security vulnerability has been detected in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. This affects the function Query of the file /MemoryState.do?Action=Query. The manipulation of the argument orderField leads to sql injection. It is possible to initiate the attack remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Streamax Crocus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025A weakness has been identified in Shenzhen Ruiming Technology Streamax Crocus 1.3.40.CVE-2025-11909 · Other software · Shenzhen Ruiming Technology · reported by VulDBLow 2.1
A weakness has been identified in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The impacted element is the function queryLast of the file /RepairRecord.do?Action=QueryLast. Executing manipulation of the argument orderField can lead to sql injection. The attack may be performed from remote. The exploit has been made available to the public and could be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Streamax Crocus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 17, 2025A security flaw has been discovered in Shenzhen Ruiming Technology Streamax Crocus 1.3.40.CVE-2025-11908 · Other software · Shenzhen Ruiming Technology · reported by VulDBLow 2.1
A security flaw has been discovered in Shenzhen Ruiming Technology Streamax Crocus 1.3.40. The affected element is the function uploadFile of the file /FileDir.do?Action=Upload. Performing manipulation of the argument File results in unrestricted upload. The attack is possible to be carried out remotely. The exploit has been released to the public and may be exploited. The vendor was contacted early about this disclosure but did not respond in any way.
- Product
- Streamax Crocus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2023Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe.CVE-2023-26108 · Other software · Nestjs · reported by report@snyk.ioLow 3.7
Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open.
- Product
- Nest
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 29, 2021A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3.CVE-2021-41764 · Other software · Streama Project · reported by MITREHigh 8.8
A cross-site request forgery (CSRF) vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when performing actions such as uploading local files. As a result, attackers could make a logged-in administrator upload arbitrary local files via a CSRF attack and send them to the attacker.
- Product
- Streama
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgist.github.comgist.github.com
Sep 6, 2012Multiple untrusted search path vulnerabilities in CyberLink StreamAuthor 4.0 build 3308 allow local users to gain privileges via a Trojan horse (1) mfc71loc.dllCVE-2012-4757 · Other software · Cyberlink · reported by MITREMedium 6.9
Multiple untrusted search path vulnerabilities in CyberLink StreamAuthor 4.0 build 3308 allow local users to gain privileges via a Trojan horse (1) mfc71loc.dll or (2) mfc71enu.dll file in the current working directory, as demonstrated by a directory that contains a .sta or .stp file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
- Product
- Streamauthor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsecunia.com
Jan 11, 2008Buffer overflow in an ActiveX control in ccpm_0237.dll for StreamAudio ChainCast ProxyManager allows remote attackers to execute arbitrary code via a long URL aCVE-2008-0248 · Other software · Streamaudio · reported by MITREHigh 9.3
Buffer overflow in an ActiveX control in ccpm_0237.dll for StreamAudio ChainCast ProxyManager allows remote attackers to execute arbitrary code via a long URL argument to the InternalTuneIn method.
- Product
- Chaincast Proxymanager Activex Control
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.grok.org.uksecunia.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.