https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 05 Oct 2026 05:59:38 +0000 https://vulnerability.circl.lu/vuln/cve-2026-85661 <p><strong>Affected:</strong> haris-musa excel-mcp-server</p> <p>excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process.</p> <p><strong>Affected:</strong> haris-musa excel-mcp-server</p> <p>excel-mcp-server 0.1.8 fails to enforce path confinement in stdio mode when EXCEL_FILES_PATH is unset, allowing attackers to read and write arbitrary files. Attackers can supply unchecked file paths to read and write tools to access any file accessible to the process.</p> https://vulnerability.circl.lu/vuln/cve-2026-85661