Universal-Tool-Calling-Protocol / Python-Utcp
9 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-101061 | utcp-gql and utcp-websocket before 1.1.1 SSRF via URL validation bypass | LOW | 2.3 | Sep 27, 2026 |
| CVE-2026-101060 | python-utcp before 1.1.4 SSRF via unvalidated HTTP redirects | HIGH | 8.4 | Sep 27, 2026 |
| CVE-2026-101059 | utcp-http before 1.1.4 OAuth2 tokenUrl Trust Boundary Bypass | HIGH | 7.1 | Sep 27, 2026 |
| CVE-2026-101058 | python-utcp before 1.1.12 SSRF via Remote HTTP Manual | HIGH | 7.1 | Sep 27, 2026 |
| CVE-2026-101057 | utcp-mcp before 1.1.3 SSRF via unvalidated MCP server URL | LOW | 2.3 | Sep 27, 2026 |
| CVE-2026-12210 | universal-tool-calling-protocol python-utcp utcp-gql/utcp-websocket server-side request forgery | MEDIUM | 5.3 | Jun 15, 2026 |
| CVE-2026-45369 | python-utcp: Command Injection via Unsanitized Argument Substitution in CLI Communication Protocol | CRITICAL | 10.0 | May 14, 2026 |
| CVE-2026-45370 | python-utcp: Full Process Environment Exposed to CLI Subprocess - Secrets Leakage via Command Injection | HIGH | 7.7 | May 14, 2026 |
| CVE-2026-44661 | python-utcp: SSRF via attacker-controlled OpenAPI servers[0].url in HTTP communication protocol | MEDIUM | 4.7 | May 14, 2026 |
Showing 1 to 9 of 9 CVEs