Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function get_journey/delete_journey/analyze_journey/usage_stats of the file src/journey/JourneyStorage.ts of the component Journey/Usage. The manipulation of the argument journeyId/filename results in path traversal. The attack requires a local approach. The project was informed of the problem early through an issue report but has not responded yet.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-19270 A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function get_journey/delete_journey/analyze_journey/usage_stats of the file … https://www.cve.org/CVERecord?id=CVE-2026-19270
Post summary
A newly discovered vulnerability (CVE-2026-19270) in Hulupeep mcp-ui-probe up to 0.2.0 targets multiple functions, but no exploit, patch, or active exploitation details are provided.
🚨*CVE* CVE-2026-19270 A security flaw has been discovered in Hulupeep mcp-ui-probe up to 0.2.0. Affected is the function get_journey/delete_journey/analyze_journey/usage_stats of the file … https://www.cve.org/CVERecord?id=CVE-2026-19270 ----- Traducción: CVE-2026-19270 Se … http://infoflow.cloud`
Post summary
The snippet announces CVE‑2026‑19270, noting its impact on specific functions in Hulupeep mcp-ui-probe up to version 0.2.0, but provides no PoC, exploit, or patch information.
📂 MCP UI Probe path-traversal vulnerability CVE-2026-19270 affects mcp-ui-probe ≤0.2.0. Journey and usage functions improperly handle identifiers/file names, allowing path traversal from a local attack context. 🔎 Source: Rapid7 / MITRE CVE #MCP #PathTraversal #CVE #CyberSecurity #AppSec
Post summary
The tweet announces CVE-2026-19270, a path-traversal flaw in mcp-ui-probe versions ≤0.2.0 that can be leveraged from a local context.