MEDIUM5.3PyPI
PYSEC-2026-2507· CVE-2026-32111, GHSA-fmfg-9g7c-3vq7ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
Modified: 7/13/2026
package
PyPI/ha-mcp
pkg:pypi/ha-mcp
MEDIUM6.8PyPI
PYSEC-2026-2508· CVE-2026-32112, GHSA-pf93-j98v-25pvha-mcp has XSS via Unescaped HTML in OAuth Consent Form
Modified: 7/13/2026
MEDIUM5.3PyPI
GHSA-fmfg-9g7c-3vq7· CVE-2026-32111, PYSEC-2026-2507ha-mcp OAuth 2.1 DCR mode enables network reconnaissance via an error oracle
Modified: 7/13/2026
MEDIUM6.5PyPI
GHSA-g39v-cvjh-8fpfHome Assistant MCP Server: YAML config backups written under www/ are served unauthenticated at /local/
Modified: 5/14/2026
MEDIUM6.8PyPI
GHSA-pf93-j98v-25pv· CVE-2026-32112, PYSEC-2026-2508ha-mcp has XSS via Unescaped HTML in OAuth Consent Form
Modified: 7/13/2026
MEDIUM6.5PyPI
GHSA-q855-8rh5-jfgqha-mcp: Add-on settings and policy routes are reachable without authentication at the bare root path
Modified: 7/7/2026