Log in Start free

universal-tool-calling-protocol

Products

ProductCVEsExploitedLatest
python-utcp9–Sep 27, 2026
typescript-utcp1–May 28, 2026

Exploited and recent CVEs

  • CVE-2026-101061 Medium 4.7 utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass 0.2%
  • CVE-2026-101060 High 8.2 python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects 0.2%
  • CVE-2026-101059 High 7.1 utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass 0.2%
  • CVE-2026-101058 Medium 6.9 python-utcp before 1.1.12 SSRF via Remote HTTP Manual 0.2%
  • CVE-2026-101057 Low 3.1 utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL 0.1%
  • CVE-2026-12210 Medium 6.3 universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery 0.2%
  • CVE-2026-45366 Medium 4.7 typescript-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol 0.1%
  • CVE-2026-45369 High 8.3 python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol 0.3%
  • CVE-2026-45370 High 7.7 python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection 0.2%
  • CVE-2026-44661 Medium 4.7 python-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol 0.2%