Oondata

Products

Exploited and recent CVEs

• CVE-2026-76894 Low 3.1 CKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out) 0.2%
• CVE-2026-61612 Medium 5.7 @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509 0.4%
• CVE-2026-53509 Medium 5.7 @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060) 0.4%
• CVE-2026-73846 Medium 6.5 CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning 0.2%
• CVE-2026-73845 Medium 5.3 CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`) 0.4%
• CVE-2026-73844 Low 3.7 CKAN MCP Server: Information disclosure via verbose error reflection 0.4%
• CVE-2026-33060 Medium 5.3 CKAN MCP Server: SSRF via base_url allows access to internal networks 0.3%