PatchSiren

@aborruso CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

Review @aborruso CVE published 2026-10-16

CVE-2026-76894

The ckan-mcp-server package has a vulnerability in its DataStore Table UI resource, which does not validate the origin of postMessage events and sends messages to a target origin of '*'. This allows any window or frame that can reach the document to inject data into the table and interfere with the MCP UI handshake. The affected product or component is ckan-mcp-server, and the vulnerability class is relat [truncated]