CVE-2026-108716Medium· 5.3▾ Sunlitmcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token en…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
mcp-remote 0.8.0 through 0.14.3 contains a cleartext transmission vulnerability in authorizeWithDeviceCode that sends client secrets and receives tokens without enforcing HTTPS endpoints. When discovered device authorization and token endpoints are non-loopback http URLs, on-path network attackers can capture the client secret plus issued access and refresh tokens.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115495Medium· 5.7Mobile VPN with SSL Client for Windows: Cleartext Transmission of VPN Credentials over Local Management Socket
CVE-2026-116844Medium· 4.8Fclairamb ftpserverlib through 0.32.4 Cleartext FTPES Data Transfer via PROT P
CVE-2026-70379Medium· 6.5Unauthorized Access to vSolution Matrix RTSP
CVE-2026-116114Low· 3.7Yoosee GM8135S Camera Live UDP H.264 Video Stream npc cleartext transmission
CVE-2026-116105Low· 3.7HeyCyan App Network Security Configuration AndroidManifest.xml cleartext transmission
CVE-2026-116166Medium· 6.8SiYuan 3.6.0 before 3.8.7 Cleartext Transmission via Unenforced networkServeTLS Setting