Redwoodjs Sdk vulnerabilities

• eventcatalog sdk eventcatalog sdk Custom Documentation Helpers custom-docs.ts rmCustomDoc path traversal CVE-2026-116046 4.8 MediumOctober 25, 2026
• @modelcontextprotocol sdk, server, modelcontextprotocol typescript-sdk +2 more Model Context Protocol TypeScript SDK: One HTTP request within the default size limit could exhaust server memory during validation CVE-2026-111768 Fix available 7.5 HighOctober 20, 2026
• @clerk express, @modelcontextprotocol sdk, server +2 more +4 more Model Context Protocol TypeScript SDK: Server bearer authentication accepted tokens issued for another service CVE-2026-111771 Fix available 6.8 MediumOctober 20, 2026
• @modelcontextprotocol client, sdk, modelcontextprotocol typescript-sdk +2 more Model Context Protocol TypeScript SDK: HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies CVE-2026-111769 Fix available 6.5 MediumOctober 20, 2026
• redwoodjs redwoodsdk, sdk +1 more RedwoodSDK: Same-site CSRF in in server actions CVE-2026-42190 Fix available 5.3 MediumApril 24, 2026
• agentfront frontmcp, frontmcp mcp-from-openapi, @frontmcp adapters +3 more +5 more FrontMCP Affected by SSRF via $ref Dereferencing in Untrusted OpenAPI Specifications CVE-2026-39885 Fix available 7.5 HighApril 8, 2026
• redwoodjs redwoodsdk, sdk +1 more RedwoodSDK has a CSRF vulnerability in server function dispatch via GET requests CVE-2026-39371 Public exploitFix available 8.1 HighApril 7, 2026
• redwoodjs sdk, tuya app +1 more Tuya App/SDK JSON Data Point denial of service CVE-2026-3465 Disputed 2.3 LowMarch 3, 2026
• dart software development kit, dart-lang flutter, sdk +2 more Dart SDK and Flutter SDK have Zip slip in Dart Pub package extraction CVE-2026-27704 6.6 MediumFebruary 25, 2026
• blyssprivacy spiral-rs, sdk +1 more In the spiral-rs crate 0.2.0 for Rust, allocation can be attempted for a ZST (zero-sized type). CVE-2025-48755 2.9 LowMay 24, 2025
• redwoodjs sdk operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic... CVE-2025-27839 3.2 LowMarch 7, 2025
• redwoodjs sdk Tuya SDK MQTT Packet denial of service CVE-2024-3764 Disputed 2.7 LowApril 14, 2024
• fujitsu displayview click, displayview click suite, hp display assistant +4 more +6 more Applications developed using the Portrait Display SDK, versions 2.30 through 2.34, default to insecure configurations which allow arbitrary code execution CVE-2017-3210 7.8 HighJuly 24, 2018
• redwoodjs sdk On the iOS platform, the ThreatMetrix SDK versions prior to 3.2 fail to validate SSL certificates provided by HTTPS connections, which may allow an attacker to perform a man-in-the-middle (MITM) attac… CVE-2017-3182 6.8 MediumJuly 24, 2018