Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

Export CSV
CVE-2026-116102

QuantGeekDev docker-mcp docker_executor.py _build_windows_command os command injection

A vulnerability was determined in QuantGeekDev docker-mcp 0.1.0/0.2.0. The impacted element is the function _build_windows_command of the file docker_executor.py. This manipulation of the argument project_name causes os command injection. It is possible to initiate the attack remotely.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Quantgeekdev
Products
Docker-mcp
CVE-2026-39313

MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport

mcp-framework is a framework for building Model Context Protocol (MCP) servers. In versions 0.2.21 and below, the readRequestBody() function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never enforced in readRequestBody(). A remote unauthenticated attacker can crash any mcp-framework HTTP server by sending a single large POST request to /mcp, causing memory exhaustion and denial of service. This issue has been fixed in version 0.2.22.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Quantgeekdev
Products
Mcp-framework