SylphxAI CVE debriefs

These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.

HIGH SylphxAI CVE published 2026-10-29

CVE-2026-62264

The `@sylphx/pdf-reader-mcp` package, when run as an HTTP server, fails to validate the `X-API-Key` header despite reading and logging an `MCP_API_KEY` environment variable at startup. This results in the `/mcp` endpoint accepting unauthenticated requests, allowing any client able to reach the server to invoke PDF tools and read the contents of any PDF the server process can open on the host. The exposure [truncated]