maximhq Bifrost

• CVE-2026-90898 Critical 9.8 Bifrost unauthenticated remote code execution via MCP stdio client registration 2.3%
• CVE-2026-86242 High 8.1 Unauthenticated RCE via Custom Plugin HTTP Path on Dynamically Linked Builds 3.6%
• CVE-2026-55245 High 8.7 Bifrost: SSRF deny-list incomplete: isPublicIP permits CGNAT, IPv6 6to4/NAT64, and site-local in FetchAndEncodeURL 0.6%