Skip to content
Redwoodjs vulnerabilities
Newest
-
eventcatalog sdk
eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal
CVE-2026-116046
4.8 Medium
-
@modelcontextprotocol sdk, server, modelcontextprotocol typescript-sdk +2 more
Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation
CVE-2026-111768
Fix available
7.5 High
-
@clerk express, @modelcontextprotocol sdk, server +2 more +4 more
Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service
CVE-2026-111771
Fix available
6.8 Medium
-
@modelcontextprotocol client, sdk, modelcontextprotocol typescript-sdk +2 more
Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies
CVE-2026-111769
Fix available
6.5 Medium
-
redwoodjs redwoodsdk, sdk +1 more
RedwoodSDK: Same-site CSRF in in server actions
CVE-2026-42190
Fix available
5.3 Medium
-
agentfront frontmcp, frontmcp mcp-from-openapi, @frontmcp adapters +3 more +5 more
FrontMCP Affected by SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications
CVE-2026-39885
Fix available
7.5 High
-
redwoodjs redwoodsdk, sdk +1 more
RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests
CVE-2026-39371
Public exploitFix available
8.1 High
-
redwoodjs sdk, tuya app +1 more
Tuya App/SDK JSON Data Point denial of service
CVE-2026-3465
Disputed
2.3 Low
-
dart software development kit, dart-lang flutter, sdk +2 more
Dart SDK and Flutter SDK have Zip slip in Dart Pub package extraction
CVE-2026-27704
6.6 Medium
-
blyssprivacy spiral-rs, sdk +1 more
In the spiral-rs crate 0.2.0 for Rust, allocation can be attempted for a ZST (zero-sized type).
CVE-2025-48755
2.9 Low
-
redwoodjs sdk
operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic...
CVE-2025-27839
3.2 Low
-
redwoodjs sdk
Tuya SDK MQTT Packet denial of service
CVE-2024-3764
Disputed
2.7 Low
-
fujitsu displayview click, displayview click suite, hp display assistant +4 more +6 more
Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution
CVE-2017-3210
7.8 High
-
redwoodjs sdk
On the iOS platform, the ThreatMetrix SDK versions prior to 3.2 fail to validate SSL certificates provided by HTTPS connections, which may allow an attacker to perform a man-in-the-middle (MITM) attac…
CVE-2017-3182
6.8 Medium