mcptoolshop vulnerabilities

Products

• @mcptoolshop/backpropagate 1

Latest mcptoolshop CVEs

Newest publication first

1. CVE-2026-48797 Backpropagate: backprop ui --auth and backprop ui --share do not enforce authentication

   Published 2026-06-16

   Critical·CVSS 9.3 EPSS 0.32%

   Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, the optional Reflex web UI exposes a training control plane without authentication: dataset upload, model load, training start/stop, multi-run orchestration, GGUF...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.