Vulnerabilities

TI-2026-70571 CVE-2026-108583 · GHSA-rc65-6pgw-cw9c

zotero-mcp SSRF via zotero_add_by_url Tool

MEDIUM 45

zotero-mcp 0.10.0 through 0.14.1 contains a server-side request forgery vulnerability that allows attackers to reach internal services because _fetch_embedded_metadata fetches URLs without destination validation.

CVSS 4.0LOW 2.3 Network No auth User interaction EPSS 0.00215 Published 2026-10-10 No fix listed CWE-918

TI-2026-06874 CVE-2026-7812 · GHSA-qwv5-f74g-8p86

54yyyu code-mcp MCP Tool server.py git_operation command injection

HIGH 70

A vulnerability was found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.01473 Published 2026-05-05 No fix listed CWE-74

TI-2026-06873 CVE-2026-7811 · GHSA-3p62-p8gh-rh2w

54yyyu code-mcp MCP File server.py is_safe_path path traversal

HIGH 70

A vulnerability has been found in 54yyyu code-mcp up to 4cfc4643541a110c906d93635b391bf7e357f4a8.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00418 Published 2026-05-05 No fix listed CWE-22

Vulnerabilities

Filters

zotero-mcp SSRF via zotero_add_by_url Tool

54yyyu code-mcp MCP Tool server.py git_operation command injection

54yyyu code-mcp MCP File server.py is_safe_path path traversal