DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL

@bytebase/dbhub's read-only mode does not prevent database writes

MCP Atlassian: Path traversal in upload_attachment allows arbitrary file

MCP Atlassian: HTTP upload tools accept arbitrary server-local file

@aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix

CodeWhale: image_analyze follows workspace symlinks, leaking external file bytes

mcp-shell — Security Disabled by Default in Bare-Binary Deploy

Xinference vulnerable to remote code execution via unsafe `eval()` in

CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27

Open WebUI: Same-origin XSS to account takeover via terminal

@dynatrace-oss/dynatrace-mcp-server's create_dynatrace_notebook missing the human

yutu: Arbitrary File Write via MCP `caption-download` Tool

IBM Langflow OSS 1.0.0 through 1.9.6 contains a Server-Side

Claude Code is an agentic coding tool. From 2.1.38 until

SearXNG MCP Server: DNS-resolved Private Hostname SSRF in `web

npm PraisonAI SandboxExecutor network-isolated mode does not block non

PraisonAI: Compute-bridged file tools allow shell command injection

Pi Agent: Potential XSS in HTML session exports via Markdown

PraisonAI ships and generates a legacy API server with authentication

wireshark-mcp vulnerable to arbitrary file write via export_objects