https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-30T13:09:29.815146+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2025-9611 CVE-2025-9611 — Microsoft Playwright MCP Server < 0.0.40 DNS Rebinding via Missing Origin Header Validation 2026-09-30T13:09:31.655052+00:00

Affected: Microsoft Playwright

Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended invocation of MCP tool endpoints.

 https://vulnerability.circl.lu/vuln/ghsa-6fg3-hvw7-2fwq GHSA-6fg3-hvw7-2fwq — Microsoft Playwright MCP Server vulnerable to DNS Rebinding Attack; Allows Attackers Access to All Server Tools 2026-09-30T13:09:31.655160+00:00

Affected: npm: @playwright/mcp

Microsoft Playwright MCP Server versions prior to 0.0.40 fails to validate the Origin header on incoming connections. This allows an attacker to perform a DNS rebinding attack via a victim’s web browser and send unauthorized requests to a locally running MCP server, resulting in unintended invocation of MCP tool endpoints.