[ Vendor · 5 CVEs ]
universal-tool-calling-protocol
CVEs affecting universal-tool-calling-protocol published in the last 30 days, plus any universal-tool-calling-protocol CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-101059 | 27 Sep 2026 | CVSS 7.1 | universal-tool-calling-protocol python-utcputcp-http before 1.1.4 fails to validate the OAuth2 tokenUrl field from remote OpenAPI specifications, allowing attackers to redirect credential… | |
| CVE-2026-101060 | 27 Sep 2026 | CVSS 8.2 | universal-tool-calling-protocol python-utcppython-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpCommunicationProtocol.call_tool that validates the… | |
| CVE-2026-101061 | 27 Sep 2026 | CVSS 4.7 | universal-tool-calling-protocol python-utcputcp-gql before 1.1.1 and utcp-websocket before 1.1.1 contain server-side request forgery vulnerabilities due to incomplete application of… | |
| CVE-2026-101057 | 27 Sep 2026 | CVSS 3.1 | universal-tool-calling-protocol python-utcputcp-mcp (the MCP plugin of python-utcp) through 1.1.2 connects to the HTTP and WebSocket MCP server URLs given in a call template's mcpServers… | |
| CVE-2026-101058 | 27 Sep 2026 | CVSS 6.9 | universal-tool-calling-protocol python-utcppython-utcp (pip package utcp-http) before 1.1.12 does not verify whether tool URLs declared in a hand-written UTCP manual point at the agent's own… |