CVE ID :CVE-2026-55604 Published : July 9, 2026, 10:17 p.m. | 15 minutes ago Description :DeepSeek MCP Server is an MCP server for DeepSeek V4. Starting in version 1.4.2 and prior to version 1.7.0, the process-global `SessionStore` accepts caller-supplied `session_id` values without binding...

#Sicherheitslücke

Original-Artikel öffnen Zurück zur Übersicht

ARTICLEVIEW

CVE-2026-55604 - @arikusi/deepseek-mcp-server has an Authorization Bypass Through User-Controlled Key

VERWANDTEARTIKEL

CVE-2026-50180 - Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

CVE-2026-54760 - Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

CVE-2026-54769 - Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent

CVE-2026-54771 - Langroid: handle_message() executes user-supplied tool JSON without sender verification

CVE-2026-55615 - Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring the SQLChatAgent bug fixed in CVE-2026-25879

CVE-2026-12595 - LoginPress Pro <= 6.2.3 - Unauthenticated Authentication Bypass via Unverified OAuth Email via Discord OAuth Callback