ST
Vendor
stacklok
13
CVEs
0
On KEV
0
New 30D
Products
MI7.5
minder
stacklok
8 CVEs0 on KEV0 new
TO8.8
toolhive
stacklok
4 CVEs0 on KEV0 new
TO8.8
toolhive-studio
stacklok
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-58197 | TO toolhive-studio stacklok | 8.8 | Sep 18 | ToolHive: containerized MCP servers can reach host services via host.docker.internal, enabling lateral movement |
| CVE-2026-58196 | TO toolhive stacklok | 4.7 | Sep 15 | ToolHive: SSRF in remote MCP server authentication discovery (host-side, bypasses container isolation) |
| CVE-2026-54450 | TO toolhive stacklok | 2.9 | Sep 15 | ToolHive: SSRF guard misses IPv6 NAT64 ranges (64:ff9b::/96, 64:ff9b:1::/48), allowing metadata/internal access behind a NAT64 gateway |
| CVE-2025-47274 | TO toolhive stacklok | 2.4 | May 12 | ToolHive stores secrets in the state store with no encryption |
| CVE-2024-37904 | MI minder stacklok | 5.7 | Jun 18 | Denial of service from maliciously configured Git repository in Minder |
| CVE-2024-35238 | MI minder stacklok | 5.3 | May 27 | Denial of service of Minder Server from maliciously crafted GitHub attestations |
| CVE-2024-35194 | MI minder stacklok | 5.3 | May 20 | Stacklok Minder vulnerable to denial of service from maliciously crafted templates |
| CVE-2024-35185 | MI minder stacklok | 5.3 | May 16 | Denial of service of Minder Server with attacker-controlled REST endpoint |
| CVE-2024-34084 | MI minder stacklok | 7.5 | May 7 | Minder's Github Webhook Handler vulnerable to denial of service from un-validated requests |
| CVE-2024-31455 | MI minder stacklok | 4.3 | Apr 9 | Minder GetRepositoryByName data leak |
| CVE-2024-27916 | MI minder stacklok | 4.3 | Mar 6 | `GetRepositoryByName`, `DeleteRepositoryByName` and `GetArtifactByName` allow access of arbitrary repositories in Minder by any authenticated user |
| CVE-2024-27093 | MI minder stacklok | 7.5 | Feb 26 | Minder trusts client-provided mapping from repo name to upstream ID |