Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: universal-tool-calling-protocol python-utcp 1.1.4 Clear all filters
TI-2026-65093 CVE-2026-101060 · GHSA-967h-fcmq-3m25

python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects

Priority HIGH 70

python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the initial tool URL but follows HTTP redirects without re-validating the target…

CVSS 4.0HIGH 8.4 Network No auth User interaction EPSS 0.00225 Published 2026-09-27 Fixed in 1.1.4 CWE-918
TI-2026-65092 CVE-2026-101059 · GHSA-r549-qqpm-phj8

utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass

Priority MEDIUM 64

utcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential submission to arbitrary endpoints.

CVSS 4.0HIGH 7.1 Network No auth User interaction EPSS 0.00225 Published 2026-09-27 Fixed in 1.1.4 CWE-918