Leshchenko1979 vulnerabilities
We track 2 vulnerabilities in Leshchenko1979 products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 28, 2026.
2vulnerabilities
1critical
1high
0exploited
8.3average CVSS score
Latest Leshchenko1979 vulnerabilities
- 7.1 High severity
fast-mcp-telegram: Incomplete List of Disallowed Inputs
fast-mcp-telegram is a Telegram MCP Server. Prior to version 30.1, the send_message/send_message_to_phone MCP tools accept files as a list of http(s) URLs, which the server downloads and attaches to the outgoing Telegram message. Downloads are guarded by _vali
- 9.4 Critical severity
fast-mcp-telegram: Improper Limitation of a Pathname to a Restricted Directory
fast-mcp-telegram is a Telegram MCP Server. Prior to 0.19.1, fast-mcp-telegram validates HTTP Bearer tokens by joining the raw token string into a session-file path. The verifier rejects the exact reserved token telegram, but it does not reject path separators