{"items":[{"id":"CVE-2026-119025","published":"2026-10-29T11:24:18.723Z","updated":"2026-11-03T15:26:15.692Z","title":"open 7.2.0 before 11.0.0 OS Command Injection via PowerShell on Windows","severity":"HIGH","score":7.7,"vendor":"sindresorhus","product":"open","kev":false,"epss":0.01446,"kevAdded":null},{"id":"CVE-2026-116686","published":"2026-10-27T19:29:16.001Z","updated":"2026-10-28T16:13:45.473Z","title":"Model Context Protocol Python SDK: Client fetched server-chosen $ref URLs while validating tool results against output schemas","severity":"MEDIUM","score":6.5,"vendor":"modelcontextprotocol","product":"python-sdk","kev":false,"epss":0.00337,"kevAdded":null},{"id":"CVE-2026-116685","published":"2026-10-27T19:26:46.926Z","updated":"2026-10-30T15:03:50.436Z","title":"Model Context Protocol Python SDK: HTTP client transports followed cross-origin redirects carrying custom headers and bodies","severity":"MEDIUM","score":5.9,"vendor":"modelcontextprotocol","product":"python-sdk","kev":false,"epss":0.00399,"kevAdded":null},{"id":"CVE-2026-116684","published":"2026-10-27T19:12:24.255Z","updated":"2026-11-02T19:40:02.808Z","title":"Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server","severity":"MEDIUM","score":6.8,"vendor":"modelcontextprotocol","product":"python-sdk","kev":false,"epss":0.00365,"kevAdded":null},{"id":"CVE-2026-111767","published":"2026-10-20T18:28:45.650Z","updated":"2026-10-20T19:02:40.151Z","title":"MCP TypeScript SDK: Experimental tasks were not tied to the session that created them","severity":"HIGH","score":8.6,"vendor":"modelcontextprotocol","product":"typescript-sdk","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-109527","published":"2026-10-14T17:52:35.943Z","updated":"2026-10-20T01:46:47.584Z","title":"Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies","severity":"HIGH","score":7.5,"vendor":"modelcontextprotocol","product":"python-sdk","kev":false,"epss":0.007,"kevAdded":null},{"id":"CVE-2026-108395","published":"2026-10-14T17:46:23.760Z","updated":"2026-10-14T19:29:00.613Z","title":"Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies","severity":"HIGH","score":7.5,"vendor":"modelcontextprotocol","product":"io.modelcontextprotocol.sdk:mcp","kev":false,"epss":0.00608,"kevAdded":null},{"id":"CVE-2026-59951","published":"2026-10-14T16:22:31.653Z","updated":"2026-10-15T15:07:43.737Z","title":"MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion","severity":"MEDIUM","score":6.9,"vendor":"modelcontextprotocol","product":"python-sdk","kev":false,"epss":0.00458,"kevAdded":null},{"id":"CVE-2026-108714","published":"2026-10-11T12:19:27.291Z","updated":"2026-10-14T13:23:01.451Z","title":"MCP Kotlin SDK through 0.15.0 Memory Exhaustion via Application.mcpWebSocket","severity":"HIGH","score":8.7,"vendor":"modelcontextprotocol","product":"kotlin-sdk","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2026-104850","published":"2026-10-06T16:08:21.514Z","updated":"2026-10-06T16:28:53.097Z","title":"MCP TypeScript SDK: OAuth client could send credentials to an authorization server chosen by the MCP server","severity":"HIGH","score":7.5,"vendor":"modelcontextprotocol","product":"typescript-sdk","kev":false,"epss":0.00226,"kevAdded":null},{"id":"CVE-2026-104120","published":"2026-10-02T02:15:18.514Z","updated":"2026-10-06T02:27:50.199Z","title":"modelcontextprotocol mcp-server-fetch/mcp-server-everything Fetch Tool server.py fetch_url server-side request forgery","severity":"MEDIUM","score":6.9,"vendor":"modelcontextprotocol","product":"mcp-server-fetch","kev":false,"epss":0.00288,"kevAdded":null},{"id":"CVE-2026-64684","published":"2026-09-16T21:18:48.886Z","updated":"2026-09-19T01:56:51.763Z","title":"RMCP: Custom HTTP headers leak to cross-origin redirect targets","severity":"MEDIUM","score":6.8,"vendor":"modelcontextprotocol","product":"rust-sdk","kev":false,"epss":0.005,"kevAdded":null},{"id":"CVE-2026-63127","published":"2026-09-16T14:50:54.296Z","updated":"2026-09-16T15:39:26.956Z","title":"RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery","severity":"HIGH","score":8.2,"vendor":"modelcontextprotocol","product":"rust-sdk","kev":false,"epss":0.00195,"kevAdded":null},{"id":"CVE-2026-63128","published":"2026-09-16T14:49:04.401Z","updated":"2026-09-16T15:18:37.976Z","title":"RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service","severity":"HIGH","score":7.5,"vendor":"modelcontextprotocol","product":"rust-sdk","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2026-53937","published":"2026-09-08T23:21:46.554Z","updated":"2026-09-14T12:09:30.392Z","title":"MCP Kotlin SDK's unbounded line buffer in StdioServerTransport/StdioClientTransport leads to memory exhaustion (DoS)","severity":"MEDIUM","score":6.2,"vendor":"modelcontextprotocol","product":"io.modelcontextprotocol:kotlin-sdk","kev":false,"epss":0.00186,"kevAdded":null},{"id":"CVE-2026-53965","published":"2026-08-25T20:36:55.186Z","updated":"2026-08-26T15:00:07.597Z","title":"MCP PHP SDK: Unbounded SSE buffer in HttpTransport enables client-side denial of service","severity":"MEDIUM","score":6.9,"vendor":"modelcontextprotocol","product":"php-sdk","kev":false,"epss":0.00615,"kevAdded":null},{"id":"CVE-2026-67432","published":"2026-07-29T19:17:46.518Z","updated":"2026-07-29T19:34:24.640Z","title":"MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport","severity":"HIGH","score":7.5,"vendor":"modelcontextprotocol","product":"ruby-sdk","kev":false,"epss":0.00784,"kevAdded":null},{"id":"CVE-2026-67431","published":"2026-07-29T19:15:32.340Z","updated":"2026-07-30T14:35:45.395Z","title":"MCP Ruby SDK: Ruby SSE Session Poisoning","severity":"HIGH","score":8.3,"vendor":"modelcontextprotocol","product":"ruby-sdk","kev":false,"epss":0.00363,"kevAdded":null},{"id":"CVE-2026-63119","published":"2026-07-29T19:12:07.687Z","updated":"2026-07-29T19:28:41.352Z","title":"MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)","severity":"MEDIUM","score":6.2,"vendor":"modelcontextprotocol","product":"ruby-sdk","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-67430","published":"2026-07-29T19:10:39.552Z","updated":"2026-07-30T15:19:09.224Z","title":"MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood","severity":"MEDIUM","score":5.3,"vendor":"modelcontextprotocol","product":"ruby-sdk","kev":false,"epss":0.00367,"kevAdded":null},{"id":"CVE-2026-63118","published":"2026-07-29T19:07:33.452Z","updated":"2026-07-29T19:35:10.375Z","title":"MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection","severity":"MEDIUM","score":6.9,"vendor":"modelcontextprotocol","product":"ruby-sdk","kev":false,"epss":0.00239,"kevAdded":null},{"id":"CVE-2026-59950","published":"2026-07-15T20:08:54.095Z","updated":"2026-07-17T12:28:19.431Z","title":"MCP Python SDK: WebSocket server transport does not support Host/Origin validation","severity":"HIGH","score":7.6,"vendor":"modelcontextprotocol","product":"python-sdk","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-52870","published":"2026-07-15T20:07:53.500Z","updated":"2026-07-16T13:01:40.089Z","title":"MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks","severity":"HIGH","score":7.6,"vendor":"modelcontextprotocol","product":"python-sdk","kev":false,"epss":0.00388,"kevAdded":null},{"id":"CVE-2026-52869","published":"2026-07-15T20:06:23.604Z","updated":"2026-07-16T13:00:37.854Z","title":"MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal","severity":"HIGH","score":7.1,"vendor":"modelcontextprotocol","product":"python-sdk","kev":false,"epss":0.00535,"kevAdded":null},{"id":"CVE-2026-44428","published":"2026-05-14T21:09:10.092Z","updated":"2026-05-15T14:22:18.973Z","title":"MCP Registry: GitHub OIDC tokens replayable across registry deployments due to shared audience","severity":"LOW","score":2.1,"vendor":"modelcontextprotocol","product":"registry","kev":false,"epss":0.00219,"kevAdded":null},{"id":"CVE-2026-44427","published":"2026-05-14T21:07:34.364Z","updated":"2026-05-15T13:33:16.949Z","title":"MCP Registry: Open Redirect","severity":"NONE","score":0,"vendor":"modelcontextprotocol","product":"registry","kev":false,"epss":0.0047,"kevAdded":null},{"id":"CVE-2026-44429","published":"2026-05-14T21:05:56.130Z","updated":"2026-05-15T14:20:27.564Z","title":"MCP Registry: Stored XSS in catalogue UI via attribute-quote breakout in publisher-controlled `websiteUrl`","severity":"MEDIUM","score":5.1,"vendor":"modelcontextprotocol","product":"registry","kev":false,"epss":0.00167,"kevAdded":null},{"id":"CVE-2026-44430","published":"2026-05-14T21:02:40.738Z","updated":"2026-05-15T18:05:09.489Z","title":"MCP Registry: Unauthenticated SSRF: HTTP namespace verification dials 6to4 / NAT64 / site-local IPv6 addresses, bypassing private-address allowlist","severity":"MEDIUM","score":6.3,"vendor":"modelcontextprotocol","product":"registry","kev":false,"epss":0.00285,"kevAdded":null},{"id":"CVE-2026-45781","published":"2026-05-14T21:00:49.961Z","updated":"2026-05-16T01:06:38.302Z","title":"MCP Registry: OCI ownership validation fails open on upstream rate limits, allowing attacker-controlled package claims","severity":"LOW","score":3.5,"vendor":"modelcontextprotocol","product":"registry","kev":false,"epss":0.00233,"kevAdded":null},{"id":"CVE-2026-42559","published":"2026-05-14T14:24:56.090Z","updated":"2026-05-14T16:00:33.149Z","title":"RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport","severity":"HIGH","score":8.8,"vendor":"modelcontextprotocol","product":"rust-sdk","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2026-35568","published":"2026-04-07T21:06:10.438Z","updated":"2026-04-08T15:43:22.962Z","title":"MCP Java-SDK has a DNS Rebinding Vulnerability","severity":"HIGH","score":7.6,"vendor":"modelcontextprotocol","product":"java-sdk","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-34742","published":"2026-04-02T18:32:34.781Z","updated":"2026-07-15T01:04:01.603Z","title":"Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost","severity":"HIGH","score":7.6,"vendor":"modelcontextprotocol","product":"go-sdk","kev":false,"epss":0.00472,"kevAdded":null},{"id":"CVE-2026-34237","published":"2026-03-31T15:40:01.070Z","updated":"2026-06-09T18:39:37.473Z","title":"MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)","severity":"MEDIUM","score":6.1,"vendor":"modelcontextprotocol","product":"java-sdk","kev":false,"epss":0.00231,"kevAdded":null},{"id":"CVE-2026-33946","published":"2026-03-27T21:20:07.900Z","updated":"2026-03-30T18:42:43.387Z","title":"MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay","severity":"HIGH","score":8.2,"vendor":"modelcontextprotocol","product":"ruby-sdk","kev":false,"epss":0.00474,"kevAdded":null},{"id":"CVE-2026-33252","published":"2026-03-23T23:44:16.106Z","updated":"2026-03-24T18:39:50.841Z","title":"MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion","severity":"HIGH","score":7.1,"vendor":"modelcontextprotocol","product":"go-sdk","kev":false,"epss":0.00181,"kevAdded":null},{"id":"CVE-2026-27896","published":"2026-02-26T00:47:46.967Z","updated":"2026-09-16T12:04:21.685Z","title":"MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity","severity":"HIGH","score":7,"vendor":"modelcontextprotocol","product":"go-sdk","kev":false,"epss":0.00292,"kevAdded":null},{"id":"CVE-2026-27735","published":"2026-02-25T23:45:52.077Z","updated":"2026-02-26T17:04:59.103Z","title":"mcp-server-git : Path traversal in git_add allows staging files outside repository boundaries","severity":"MEDIUM","score":6.4,"vendor":"modelcontextprotocol","product":"servers","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-25536","published":"2026-02-04T21:29:38.276Z","updated":"2026-07-15T01:16:18.414Z","title":"@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse","severity":"HIGH","score":7.1,"vendor":"modelcontextprotocol","product":"typescript-sdk","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2025-68145","published":"2025-12-17T22:12:45.410Z","updated":"2025-12-18T15:06:54.784Z","title":"mcp-server-git has missing path validation when using --repository flag","severity":"MEDIUM","score":6.4,"vendor":"modelcontextprotocol","product":"servers","kev":false,"epss":0.07032,"kevAdded":null},{"id":"CVE-2025-68144","published":"2025-12-17T22:10:56.086Z","updated":"2025-12-18T15:07:03.402Z","title":"mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files","severity":"MEDIUM","score":6.3,"vendor":"modelcontextprotocol","product":"servers","kev":false,"epss":0.07209,"kevAdded":null},{"id":"CVE-2025-68143","published":"2025-12-17T22:09:43.159Z","updated":"2025-12-18T15:07:15.061Z","title":"mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations","severity":"MEDIUM","score":6.5,"vendor":"modelcontextprotocol","product":"servers","kev":false,"epss":0.08134,"kevAdded":null},{"id":"CVE-2025-66416","published":"2025-12-02T18:14:28.310Z","updated":"2025-12-02T18:45:53.656Z","title":"DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost","severity":"HIGH","score":7.6,"vendor":"modelcontextprotocol","product":"python-sdk","kev":false,"epss":0.00544,"kevAdded":null},{"id":"CVE-2025-66414","published":"2025-12-02T18:12:29.848Z","updated":"2025-12-02T18:46:02.374Z","title":"DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost","severity":"HIGH","score":7.6,"vendor":"modelcontextprotocol","product":"typescript-sdk","kev":false,"epss":0.00544,"kevAdded":null},{"id":"CVE-2025-58444","published":"2025-09-08T21:24:58.821Z","updated":"2025-09-09T13:31:04.737Z","title":"MCP Inspector is Vulnerable to Potential Command Execution via XSS When Connecting to an Untrusted MCP Server","severity":"HIGH","score":8.6,"vendor":"modelcontextprotocol","product":"inspector","kev":false,"epss":0.00705,"kevAdded":null},{"id":"CVE-2025-53366","published":"2025-07-04T22:05:02.975Z","updated":"2025-07-08T13:52:28.447Z","title":"MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service","severity":"HIGH","score":8.7,"vendor":"modelcontextprotocol","product":"python-sdk","kev":false,"epss":0.09754,"kevAdded":null},{"id":"CVE-2025-53365","published":"2025-07-04T22:03:46.893Z","updated":"2025-07-08T13:53:36.518Z","title":"MCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of Service","severity":"HIGH","score":8.7,"vendor":"modelcontextprotocol","product":"python-sdk","kev":false,"epss":0.00419,"kevAdded":null},{"id":"CVE-2025-53109","published":"2025-07-02T14:30:57.647Z","updated":"2025-07-02T14:50:18.562Z","title":"Model Context Protocol Servers Vulnerable to Path Validation Bypass via Prefix Matching and Symlink Handling","severity":"HIGH","score":7.3,"vendor":"modelcontextprotocol","product":"servers","kev":false,"epss":0.00765,"kevAdded":null},{"id":"CVE-2025-53110","published":"2025-07-02T14:30:39.947Z","updated":"2025-07-02T15:13:59.600Z","title":"Model Context Protocol Servers Vulnerable to Path Validation Bypass via Colliding Path Prefix","severity":"HIGH","score":7.3,"vendor":"modelcontextprotocol","product":"servers","kev":false,"epss":0.0058,"kevAdded":null},{"id":"CVE-2025-49596","published":"2025-06-13T20:11:40.453Z","updated":"2025-07-09T20:19:02.667Z","title":"MCP Inspector proxy server lacks authentication between the Inspector client and proxy","severity":"CRITICAL","score":9.4,"vendor":"modelcontextprotocol","product":"inspector","kev":false,"epss":0.44453,"kevAdded":null}]}