Tag archive

Cve 2026 104850

Coverage tagged cve 2026 104850.

Cve 2026 104850 AI Security

MCP TypeScript SDK Lets a Malicious Server Pull OAuth Secrets From Clients (CVE-2026-104850)

CVE-2026-104850 lets a malicious MCP server make the TypeScript SDK's OAuth client send refresh tokens and client secrets to an attacker's server. Fixed in 1.31.0 / 2.2.0.

Related desks

AI Security

Latest

Oct 6, 2026, 10:34 PM EDT · Research · Ai Api Pricing5 minOpenAI Collapses API Usage Tiers From Five to Three: Grow Unlocks $200,000 a Month at $500

OpenAI's API now has three paid usage tiers, Build, Launch and Grow. Grow needs $500 in total purchases, down from $1,000, and keeps its $200,000 monthly limit.

Oct 6, 2026, 9:31 PM EDT · AI Security · Cve 2026 1048504 minMCP TypeScript SDK Lets a Malicious Server Pull OAuth Secrets From Clients (CVE-2026-104850)

CVE-2026-104850 lets a malicious MCP server make the TypeScript SDK's OAuth client send refresh tokens and client secrets to an attacker's server. Fixed in 1.31.0 / 2.2.0.

Oct 6, 2026, 10:31 AM EDT · AI Security · Mistral6 minMistral Large 4 preview ships a reduced-moderation cyber tier, and Artificial Analysis lists its 82% as the top score

Mistral Large 4 is in preview, with vetted partners and states getting a reduced-moderation cyber tier. Artificial Analysis lists its 82% CyberGym score as the top of 18 models.

Oct 5, 2026, 9:42 PM EDT · AI Security · Langflow5 minLangflow MCP Stdio Flaws Give Any Logged-In User a Shell: CVE-2026-105697 and CVE-2026-105740

Two CVSS 9.9 command-injection flaws in Langflow's MCP stdio transport let a low-privileged user run host commands. Fixed in 1.10.3; no exploitation reported.