ondata vulnerabilities

Newest CVEs

• CVE-2026-76894

  CKAN MCP Server: DataStore Table UI resource does not validate postMessage origin (in) and posts to targetOrigin "*" (out)

  ondata · ckan-mcp-server

  Low3.1
• CVE-2026-61612

  @aborruso/ckan-mcp-server has SSRF via DNS-name → internal IP — incomplete fix of CVE-2026-53509

  ondata · ckan-mcp-server

  Medium5.7
• CVE-2026-53509

  @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)

  ondata · ckan-mcp-server

  Medium5.7
• CVE-2026-73846

  CKAN MCP Server: Cache-key canonicalization collision enables cache confusion / poisoning

  ondata · ckan-mcp-server

  Medium6.5
• CVE-2026-73845

  CKAN MCP Server: MQA server allowlist bypass via unanchored regex (`isValidMqaServer`)

  ondata · ckan-mcp-server

  Medium5.3
• CVE-2026-73844

  CKAN MCP Server: Information disclosure via verbose error reflection

  ondata · ckan-mcp-server

  Low3.7
• CVE-2026-33060

  CKAN MCP Server: SSRF via base_url allows access to internal networks

  ondata · ckan-mcp-server

  Medium5.3