Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Vendor: hyper-mcp-rs Clear all filters
TI-2026-70679 CVE-2026-108699 · GHSA-4j25-h357-wg62

hyper-mcp loads WebAssembly plugins without proper signature verification

Priority HIGH 69

hyper-mcp through 0.8.3 contains an improper signature verification vulnerability that allows attackers to load malicious WebAssembly plugins because cosign_verify_args() accepts any signer identity and OIDC issuer by de…

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00169 Published 2026-10-11 No fix listed CWE-347
TI-2026-70678 CVE-2026-108698 · GHSA-phv4-c98f-77h3

TOCTOU race in hyper-mcp lets attackers load unsigned plugins

Priority LOW 36

hyper-mcp through 0.8.3 contains a signature verification bypass vulnerability in load_wasm in src/wasm/oci.rs that verifies the Cosign signature of a separately resolved tag rather than the loaded manifest.

CVSS 4.0HIGH 8.3 Network No auth No interaction EPSS 0.00243 Published 2026-10-11 No fix listed CWE-367