@modelcontextprotocol/server-slack is a MCP server for interacting with Slack

Affected versions of this package are vulnerable to Improper Neutralization of Input Used for LLM Prompting via the automatic link unfurling process. An attacker can access sensitive information by manipulating an AI agent to generate messages containing attacker-crafted hyperlinks embedding sensitive data, which are then processed by link preview bots and sent to attacker-controlled URLs, enabling zero-click data exfiltration.

OpenEXR is a Python bindings for the OpenEXR image file format

Affected versions of this package are vulnerable to Heap-based Buffer Overflow via undo_zip_impl function during a write operation when decompressing ZIPS-packed deep scan-line EXR files. An attacker can write arbitrary data to the heap and potentially execute code by supplying a specially crafted EXR file with a forged chunk header.

org.apache.jspwiki:jspwiki-main is a main release jar for Apache JSPWiki engine.

Affected versions of this package are vulnerable to Cross-site Scripting (XSS) via the Image plugin. An attacker can execute arbitrary JavaScript in a victim's browser and access sensitive information by crafting a malicious request.