Catalog
Findings
Filter the merged record by severity, source, stack, and weakness type.
- High8.7Weaver (Fanwei) E-cology 9.5 versions prior to 10.52 contain an arbitrary file read vulnerability in the XmlRpcServlet interface at the XML-RPC endpoint that allows un…EPSS 0.7%Apr 30, 2026
- Critical9.8ColorOS Assistant has an unauthenticated start-download channel, leading to file path traversal.EPSS 0.2%Apr 30, 2026
- Low2.1A security vulnerability has been detected in ZachHandley ZMCPTools up to 0.2.2.Apr 30, 2026
- Medium5.5A weakness has been identified in getsimpletool mcpo-simple-server up to 0.2.0.Apr 29, 2026
- Medium5.5A security flaw has been discovered in geldata gel-mcp 0.1.0.Apr 29, 2026
- Medium5.5A security vulnerability has been detected in geekgod382 filesystem-mcp-server 1.0.0.Apr 29, 2026
- High7.1LifeSize ClearSea 3.1.4 contains directory traversal vulnerabilities that allow authenticated attackers to download and upload arbitrary files by manipulating path par…EPSS 0.9%Apr 29, 2026
- High7.1VideoFlow Digital Video Protection DVP 2.10 contains an authenticated directory traversal vulnerability that allows attackers with valid credentials to disclose arbitr…EPSS 0.6%Apr 29, 2026
- High8.7BuddyPress Xprofile Custom Fields Type 2.6.3 contains a remote code execution vulnerability that allows authenticated users to delete arbitrary files by manipulating u…EPSS 0.7%Apr 29, 2026
- Medium5.5A weakness has been identified in florensiawidjaja BioinfoMCP up to 7ada7918b9e515604d3c0ae264d3a9af10bf6e54.Apr 29, 2026
- Critical9.9Wazuh is a free and open source platform used for threat prevention, detection, and response.Apr 29, 2026
- Medium5.5A vulnerability was identified in NousResearch hermes-agent 0.8.0.Apr 29, 2026
- Medium5.5A flaw has been found in fatbobman mail-mcp-bridge up to 1.3.3.Apr 29, 2026
- Critical9.6Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Software…Apr 29, 2026
- Medium6.5Cockpit 2.13.5 and earlier is vulnerable to directory traversal via the Buckets component.Apr 29, 2026
- Medium5.5A vulnerability was detected in ezequiroga mcp-bases 357ca19c7a49a9b9cb2ef639b366f03aba8bea39/c630b8ab0f970614d42da8e566e9c0d15a16414c.Apr 29, 2026
- High7.5Jenkins Credentials Binding Plugin 719.v80e905ef14eb_ and earlier does not sanitize file names for file and zip file credentials, allowing attackers able to provide cr…Apr 29, 2026
- High7.7Ollama for Windows contains a Remote Code Execution vulnerability in its update mechanism due to improper handling of attacker‑controlled HTTP response headers.Apr 29, 2026
- Medium5.5A flaw has been found in elinsky execution-system-mcp 0.1.0.Apr 28, 2026
- Low2.0A vulnerability was detected in elie mcp-project 0.1.0.Apr 28, 2026
- Medium5.5A flaw has been found in eiceblue spire-pdf-mcp-server 0.1.1.Apr 28, 2026
- Medium5.5A vulnerability was detected in eiceblue spire-doc-mcp-server 1.0.0.Apr 28, 2026
- Medium6.0OpenClaw before 2026.4.8 contains a filesystem policy bypass vulnerability in docx upload processing that allows local file reads outside workspace boundaries.Apr 28, 2026
- Medium6.1OpenClaw before 2026.4.2 contains an arbitrary directory deletion vulnerability in mirror mode that allows attackers to delete remote directories by influencing remote…Apr 28, 2026
- Medium5.5A flaw has been found in WilliamCloudQi matlab-mcp-server up to ab88f6b9bf5f36f725e8628029f7f6dd0d9913ca.Apr 28, 2026