https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-16T21:38:13.766674+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-336972 EUVD-2026-336972 2026-10-16T21:38:13.914564+00:00 EUVD-2026-336972 https://cve.radiocsirt.org/vuln/fkie_cve-2026-58168 fkie_cve-2026-58168 2026-10-16T21:38:13.914604+00:00

DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources.

 https://cve.radiocsirt.org/vuln/ghsa-jg88-rvpc-qvxj GHSA-jg88-rvpc-qvxj — DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools 2026-10-16T21:38:13.914640+00:00

Affected: PyPI: deeptutor

DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources.

 https://cve.radiocsirt.org/vuln/pysec-2026-4206 PYSEC-2026-4206 — DeepTutor missing MCP tool authorization allows non-admin users to invoke unrestricted tools 2026-10-16T21:38:13.914668+00:00

Affected: PyPI: deeptutor

DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools is omitted from a user's grant in deeptutor/multi_user/tool_access.py. Attackers or prompt-injected content acting within a user session can enumerate and invoke any configured MCP tool, including filesystem, shell, and browser servers, gaining unauthorized access to sensitive deployment resources.