PULSE
LIVE6signals / 24h
FEED
ransomincransom reclama a harwal.net · AE · Not Foundransomakira reclama a Northwood Country Club · Hospitalityransomsection9 reclama a ****.com.pa · PA · Not Foundransomspacebears reclama a StellarRAD Systems · US · Technologyransomaurora reclama a Bretford Manufacturing · US · Manufacturingransomgunra reclama a Weilhotel · MY · Hospitalityransomdeadlock reclama a AHENK lab · TR · Technologyransomqilin reclama a Hoc · GB · Not Foundransomblacknevas reclama a Speed Group · Transportationransomthegentlemen reclama a Buck Knives · US · Manufacturingransomcoinbasecartel reclama a Accesso · GB · Technologyransomchaos reclama a thecranewaregroup.com · GB · Technologyransomcmdorganization reclama a B-K Tool & Design · US · Manufacturingransomdeadlock reclama a DIATER · ES · Manufacturingransomincransom reclama a harwal.net · AE · Not Foundransomakira reclama a Northwood Country Club · Hospitalityransomsection9 reclama a ****.com.pa · PA · Not Foundransomspacebears reclama a StellarRAD Systems · US · Technologyransomaurora reclama a Bretford Manufacturing · US · Manufacturingransomgunra reclama a Weilhotel · MY · Hospitalityransomdeadlock reclama a AHENK lab · TR · Technologyransomqilin reclama a Hoc · GB · Not Foundransomblacknevas reclama a Speed Group · Transportationransomthegentlemen reclama a Buck Knives · US · Manufacturingransomcoinbasecartel reclama a Accesso · GB · Technologyransomchaos reclama a thecranewaregroup.com · GB · Technologyransomcmdorganization reclama a B-K Tool & Design · US · Manufacturingransomdeadlock reclama a DIATER · ES · Manufacturing
← All CVEs
CVE WatchJul 29, 2026

CVE-2026-67431

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHT

CVSS

No CVSS

EPSS

KEV

Exploit Today

0-100

Published: Jul 29, 2026 · Last modified: Jul 29, 2026 · CWE-284

EPSS · 30d

Not enough EPSS history yet.

Technical description

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with a stolen session ID to send tools/call requests that execute in the victim's session. This issue is fixed in version 0.23.0.

Official references
Related CVEs
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-65888
Joomla Extension - balbooa.com - Account takeover vulnerability in Gridbox < 2.20.2 - The socialLogin method allows actors to login as any given user on the target site.12h
CVE-2026-65887
Joomla Extension - balbooa.com - Unauthenticated arbitrary password reset in Gridbox < 2.20.2 - The resetPassword method allows actors to reset any user password, allowing to login and act as these users - excluding super admins.12h
CVE-2026-65889
Joomla Extension - balbooa.com - Unauthenticated recursive directory deletion < 2.20.2 - The generateNewApp method allows actors to recursively delete directories.12h
CVE-2026-659437.5 HIG
Joomla Extension - rolandd.com - Unauthenticated directory creation RO CSVI < 9.11.011h
CVE-2026-65884
Joomla Extension - balbooa.com - Privilege Escalation in Gridbox < 2.20.2 - The registration method allows users provided usergroup IDs, allowing unauthenticated actors to register new accounts with administrative permissions.12h
CVE-2026-419209.3 CRI
0Improper Access Control vulnerability in Apache Traffic Server. This issue affects Apache Traffic Server: from 9.0.0 through 9.1.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.1.15 or 10.1.4, which fixes the issue.13h