← All credits
Avishai Gonen (Pluto Security)
10 vulnerability records and advisories credit this contributor.
CVE-2026-81735
UI-TARS-desktop @agent-infra MCP Servers Bind Every Interface Without Authentication, Exposing Arbitrary Command Execution
CVE-2026-81102
Dropbox Dash MCP Server DNS Rebinding via Missing Host Header Validation
CVE-2026-81101
Airtable MCP CLI before 0.2.5 Credential Disclosure via Unvalidated Configured Endpoint
CVE-2026-81099
Timescale tiger-slack DNS Rebinding via Disabled Host Header Allow-List
CVE-2026-81098
Telnyx MCP Server through 6.83.0 Missing Authentication on Streamable HTTP Transport
CVE-2026-81097
rails-mcp-server 1.4.0 through 1.6.0 OS Command Execution via execute_ruby PTY Escape
CVE-2026-81096
ToolUniverse through 1.2.6 Unauthenticated Remote Code Execution via python_code_executor Sandbox Escape
CVE-2026-81092
mcp-go before 0.56.0 Missing Host Header Validation Enables DNS Rebinding
CVE-2026-81100
Timescale tiger-gh-mcp-server DNS Rebinding via Disabled Host Header Allow-List
CVE-2026-81095
Timescale pg-aiguide through 0.5.0 DNS Rebinding via Disabled Host Header Allow-List