Security Advisories

Vulnerability Research

Latest Advisory

TFSA-2026-006 : OAuth authorization-code interception in the Neon MCP broker

In the tested Neon MCP OAuth broker, downstream routing data was carried in an unsigned state value, letting an authorization code be forwarded to a client the testing party controlled. Reported; closed as duplicate.

September 24, 2026

Read advisory

Explore Advisories

High

September 24, 2026

TFSA-2026-006 : OAuth authorization-code interception in the Neon MCP broker

TFSA-2026-006

CWE-352

Read advisory

Critical

September 22, 2026

CVE-2026-79538 : Authenticated OS command injection and container RCE in metatool-ai/metamcp

CVE-2026-79538

CWE-78

Read advisory

High

September 22, 2026

CVE-2026-79537 : Cross-tenant session hijack in metatool-ai/metamcp

CVE-2026-79537

CWE-639

Read advisory

Critical

September 22, 2026

CVE-2026-79536 : Read-only mode bypass in bytebase/dbhub on MySQL and MariaDB

CVE-2026-79536

CWE-863

Read advisory

Medium

September 22, 2026

CVE-2026-79534 : Symlink allow-list bypass in mark3labs/mcp-filesystem-server

CVE-2026-79534

CWE-59

Read advisory

Medium

September 22, 2026

CVE-2026-79535 : OS command injection in mbailey/voicemode update_config

CVE-2026-79535

CWE-78

Read advisory

Thank you! Your submission has been received!

Oops! Something went wrong while submitting the form.

Vulnerability Research

TFSA-2026-006 : OAuth authorization-code interception in the Neon MCP broker

Explore Advisories

Observe and Secure AI at the device layer