This page lists every AI IDE and Model Context Protocol disclosure the site tracks, 172 in total, collected daily from NVD, GitHub security advisories for 9 MCP and AI-agent repositories, and the CISA KEV catalog. The earliest dated entry is from May 25, 2026. Scores are CVSS base scores, v3.1 where NVD carries one and v4.0 where that is the only rating published, taking the rating NVD marks primary when one exists. Entries NVD has not yet analysed, or has deferred, show the reporting CNA's own assessment instead.
Last updated: October 30, 2026
| Published | ID | Affected product | Severity | Summary |
|---|---|---|---|---|
| October 30, 2026 | CVE-2026-62331 | praktor | High 8.2 (v3.1) | Prior to 0.9.1, both Telegram upload sites in `internal/telegram/bot.go` concatenate the attacker-controlled document filename into a... |
| October 30, 2026 | CVE-2026-62264 | PDF Reader MCP | High 7.5 (v3.1) | In versions 2.2.0 and later prior to 3.0.1, when `MCP_TRANSPORT=http` enables the opt-in HTTP server, `@sylphx/pdf-reader-mcp` reads `MCP_API_KEY` and logs that `X-API-Key`... |
| October 28, 2026 | GHSA-w766-5x43-whvw | Medium 5.3 | mcp-server-git: nested gitdir file bypasses --repository confinement | |
| October 27, 2026 | CVE-2026-116686 | Model Context Protocol Python SDK | Medium 6.5 (v3.1) | From 1.10.0 until 1.30.0 and 2.2.0, ClientSession, ClientSessionGroup, and Client tool calls validate server-declared outputSchema documents with... |
| October 27, 2026 | CVE-2026-116685 | Model Context Protocol Python SDK | Medium 5.9 (v3.1) | From 1.8.0 until 1.30.0 and 2.2.0, streamable_http_client, streamablehttp_client, sse_client, ClientSessionGroup, OAuth, and... |
| October 27, 2026 | CVE-2026-116684 | Model Context Protocol Python SDK | Medium 6.8 (v3.1) | From 1.10.0 until 1.30.0 and 2.2.0, server-side bearer authentication configured through AuthSettings with token_verifier accepts a valid token... |
| October 25, 2026 | GHSA-v38p-wf49-hx2j | mcp-server-fetch | Medium | fetch: private-address guard bypass via IDNA hostnames (check and connect resolve different names) |
| October 25, 2026 | GHSA-mvf5-2qqv-rg3c | Medium 6.5 | Cross-Origin Environment Variable Exfiltration in @modelcontextprotocol/server-everything | |
| October 25, 2026 | GHSA-hhwq-wxfx-cj7g | Low 3.1 | @modelcontextprotocol/server-filesystem list_directory_with_sizes follows symlinks and leaks outside-directory file metadata | |
| October 25, 2026 | GHSA-66qx-2266-pmj6 | Low 3.1 | fetch server: SSRF guard treats the well-known NAT64 prefix 64:ff9b::/96 as public, so a metadata address is reachable on NAT64/DNS64 egress | |
| October 25, 2026 | GHSA-53mr-w429-c597 | Low 2.2 | Parent-Directory Fallback TOCTOU in @modelcontextprotocol/server-filesystem Permits Arbitrary File Write Outside allowedDirectories | |
| October 25, 2026 | GHSA-4gxg-m5jx-9j57 | Medium 5.3 | Case-variant path bypasses symlink check and allows creating files outside allowed directories in server-filesystem | |
| October 25, 2026 | GHSA-3jqg-r5pp-rmp2 | Low 3.1 | robots.txt enforcement bypass via HTTP redirects in mcp-server-fetch | |
| October 23, 2026 | CVE-2026-57207 | NetBox MCP Server | Medium 5.9 (v3.1) | Prior to version 1.2.1, when running with TRANSPORT=http, the MCP server has no authentication on the HTTP endpoint. Any client that can reach the port gets a valid MCP session... |
| October 23, 2026 | CVE-2026-115478 | obsidian-tc | High 7.1 (v4.0) | From 1.0.1 until 1.31.4, `create_entity`, `link_entities`, `rename_entity`, `unlink_entities` and `delete_entity` regenerate memory notes from SQLite at the computed... |
| October 23, 2026 | CVE-2026-115477 | obsidian-tc | High 7.1 (v4.0) | From 1.13.0 until 1.31.4, on a Streamable HTTP deployment with `auth.jwtSecret` configured and a 2026-07-28-era client declaring `elicitation.form` support, a... |
| October 21, 2026 | CVE-2026-114123 | D365 F&O MCP Server | High 7.5 (v3.1) | Prior to version 1.11.0, the officially documented Azure one-click deployment uses infrastructure/azuredeploy.json and... |
| October 20, 2026 | CVE-2026-111767 | MCP TypeScript SDK | High 8.6 (v3.1) | From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients sharing one... |
| October 16, 2026 | CVE-2026-96620 | Claude Agent SDK | Critical 9.2 (v4.0) | Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config... |
| October 15, 2026 | GHSA-jm63-cq47-j5jp | High 7.7 | Shared transport or server instances delivered one HTTP client's messages to another | |
| October 15, 2026 | GHSA-f897-62hf-6gxq | High 7.5 | HTTP server transports and handlers did not limit request body size or JSON-RPC batch length | |
| October 15, 2026 | CVE-2026-111770 | High 7.7 | Shared transport or server instances delivered one HTTP client's messages to another | |
| October 14, 2026 | CVE-2026-109527 | Model Context Protocol Python SDK | High 7.5 (v3.1) | In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth... |
| October 14, 2026 | CVE-2026-108395 | Model Context Protocol Java SDK | High 7.5 (v3.1) | From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in... |
| October 13, 2026 | CVE-2026-86063 | Claude Code | High 7.5 (v4.0) | Prior to 2.1.179, the Claude Code and Claude Desktop plugin installation flow runs git checkout for a marketplace-pinned commit without verifying that the resulting HEAD equals the pinned 40-character SHA. An attacker... |
| October 13, 2026 | CVE-2026-77362 | obsidian-tc | Medium 4.3 (v3.1) | Prior to 1.3.1, bridge tools do not consistently apply the read access-control list (ACL) to every returned field. The tasks_filter tool exposes group counts derived... |
| October 13, 2026 | CVE-2026-77361 | obsidian-tc | Medium 4.7 (v3.1) | Prior to 1.3.1, read access-control list (ACL) checks use a lexical vault-relative path while containment checks use the resolved path. An in-vault symlink under an... |
| October 13, 2026 | CVE-2026-110206 | Roo Code | High 8.8 (v3.1) | Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that allows attackers to auto-approve arbitrary shell commands by placing a command substitution in command position. Attackers using indirect prompt injection... |
| October 13, 2026 | CVE-2026-110205 | Roo Code | High 8.8 (v3.1) | Roo Code through 3.54.0 contains a command approval bypass vulnerability in parseCommandLine() that discards command substitutions placed next to * or ? glob characters. Attackers using indirect prompt injection can craft commands like echo *$(...) that... |
| October 13, 2026 | CVE-2026-110204 | Roo Code | High 8.8 (v3.1) | Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to run denied shell commands because parseCommandLine() treats ${ command; } substitutions as parameter expansions. Attackers using indirect prompt injection can... |
| October 13, 2026 | CVE-2026-110203 | Roo Code | High 8.8 (v3.1) | Roo Code through 3.54.0 contains a command approval bypass vulnerability that allows attackers to auto-approve denied shell commands by abusing quote-masking regex in parseCommandLine(). Attackers can use indirect prompt injection with escaped or... |
| October 13, 2026 | CVE-2026-110202 | Roo Code | High 8.8 (v3.1) | Roo Code through 3.54.0 contains a command approval bypass vulnerability in getCommandDecision() that allows attackers to auto-approve denied shell commands by prefixing them with a bare >& redirect. Attackers using indirect prompt injection can make the... |
| October 12, 2026 | CVE-2026-77366 | obsidian-tc | Critical 9.9 (v3.1) | Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token (JWT) has no vault claim,... |
| October 12, 2026 | CVE-2026-77364 | obsidian-tc | Medium 6.5 (v3.1) | Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash... |
| October 12, 2026 | CVE-2026-77363 | obsidian-tc | High 8.8 (v3.1) | Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration... |
| October 9, 2026 | CVE-2026-107824 | x64dbg-MCP Server | Critical 9.3 (v4.0) | Prior to 1.1, x64dbg-MCP Server exposes all MCP debugger tools over HTTP and SSE without authentication while listening on... |
| October 9, 2026 | CVE-2026-107820 | x64dbg-MCP Server | Medium 5.3 (v3.1) | Prior to 1.2, src/core/mcp_server.zig parses an unbounded Content-Length value in parseContentLength() and uses it in... |
| October 5, 2026 | GHSA-w4fh-qvv9-3v23 | Medium 6.8 | Server bearer-token authentication accepts tokens issued for a different resource server | |
| October 5, 2026 | GHSA-rvq5-wwqv-78pq | Medium 6.8 | Server bearer authentication accepted tokens issued for another service | |
| October 5, 2026 | CVE-2026-111771 | Medium 6.8 | Server bearer authentication accepted tokens issued for another service | |
| October 5, 2026 | CVE-2026-105741 | Langflow | High 7.1 (v3.1) | From 1.5.0 until 1.10.3, an IP spoofing vulnerability in the Model Context Protocol (MCP) configuration installation endpoint (POST /api/v1/mcp/project/{project_id}/install)... |
| October 2, 2026 | GHSA-6prh-2h8m-c8cw | Medium 6.5 | HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies | |
| October 2, 2026 | GHSA-5h93-6whr-6q8j | Medium 5.9 | HTTP client transports followed cross-origin redirects carrying custom headers and bodies | |
| October 2, 2026 | CVE-2026-94486 | Next.js | Low 2.3 (v4.0) | Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the next dev development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a... |
| October 2, 2026 | CVE-2026-94485 | Next.js | Medium 6.3 (v4.0) | Next.js is a React framework for building full-stack web applications. From 16.0.0 until 16.3.8, the `next dev` development server exposes a Model Context Protocol endpoint without reliably restricting cross-site requests. A malicious website visited by a... |
| October 2, 2026 | CVE-2026-111769 | Medium 6.5 | HTTP client transports and OAuth requests followed cross-origin redirects and re-sent custom headers and request bodies | |
| September 30, 2026 | GHSA-fmmv-w9g8-j3gc | High 7.5 | HTTP server transports and OAuth endpoints read request bodies with no size limit | |
| September 30, 2026 | GHSA-6qxp-vccf-f47h | High 7.5 | OAuth client could send credentials to an authorization server chosen by the MCP server | |
| September 30, 2026 | CVE-2026-59951 | High 7.5 | Streamable HTTP sessions were never reclaimed by default and kept their initialize payloads | |
| September 30, 2026 | CVE-2026-104850 | High 7.5 | OAuth client could send credentials to an authorization server chosen by the MCP server | |
| September 30, 2026 | CVE-2026-103012 | Low 2.0 (v4.0) | Claude Code selected an API key stored by Claude Code, for example from an earlier `/login` or written directly to its configuration, ahead of the user's valid Claude Enterprise or Team sign-in when fetching the organization's server-managed settings, even... | |
| September 28, 2026 | GHSA-rwrf-2pqf-9j8j | Medium 6.5 | Client fetched server-chosen $ref URLs while validating tool results against output schemas | |
| September 28, 2026 | GHSA-qx49-fqc8-xw99 | High 7.5 | OAuth client could send credentials to an authorization server chosen by the MCP server | |
| September 28, 2026 | CVE-2026-115563 | High 7.5 | OAuth client could send credentials to an authorization server chosen by the MCP server | |
| September 26, 2026 | CVE-2026-100585 | OpenClaw | High 8.0 (v3.1) | OpenClaw (npm package `openclaw`) before 2026.7.1 fails to enforce the owner-only authorization requirement for Claude Code permission prompts delivered through the MCP channel bridge. An authorized non-owner channel sender with channel command access can... |
| September 22, 2026 | CVE-2026-77274 | MCP Atlassian | High 8.8 (v4.0) | Prior to 0.22.0, validate_url_for_ssrf has a backslash authority confusion because it interprets the authority differently from the Requests connection layer... |
| September 22, 2026 | CVE-2026-77272 | MCP Atlassian | Medium 5.4 (v3.1) | Prior to 0.22.0, the OAuth error query parameter is passed to CallbackHandler._send_response in oauth_setup.py and interpolated into an HTML page without... |
| September 22, 2026 | CVE-2026-77271 | MCP Atlassian | High 8.3 (v4.0) | Prior to 0.22.0, validate_safe_path defaults its base directory to os.getcwd(), and affected Confluence attachment call sites omit base_dir, allowing... |
| September 22, 2026 | CVE-2026-77270 | MCP Atlassian | Medium 6.5 (v3.1) | Prior to 0.22.0, the Jira and Confluence attachment upload tools treat caller-controlled file_path values as trusted server-local paths. The server opens the... |
| September 22, 2026 | CVE-2026-77269 | MCP Atlassian | Medium 6.5 (v3.1) | Prior to 0.22.0, the remediation for CVE-2026-27825 protects download destinations but does not constrain source paths used by attachment uploads. A caller... |
| September 22, 2026 | CVE-2026-77268 | MCP Atlassian | Medium 5.5 (v3.1) | Prior to 0.22.0, the OAuth fallback token directory and JSON file are created without explicit owner-only modes. Local users or processes with access through... |
| September 22, 2026 | CVE-2026-77267 | MCP Atlassian | High 8.3 (v4.0) | Prior to 0.22.0, the X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url headers are processed by _process_authentication_headers and used to construct... |
| September 22, 2026 | CVE-2026-77266 | MCP Atlassian | Medium 6.5 (v3.1) | Prior to 0.22.0, upload_attachment accepts absolute paths and traversal sequences without constraining the resolved path to the server workspace. An MCP... |
| September 22, 2026 | CVE-2026-77265 | MCP Atlassian | Medium 5.9 (v3.1) | Prior to 0.22.0, header-supplied Jira or Confluence URLs are resolved and validated before the HTTP client resolves the hostname again for the connection. An... |
| September 22, 2026 | CVE-2026-77262 | MCP Atlassian | High 8.6 (v3.1) | Prior to 0.22.0, confluence_upload_attachment accepts an attacker-controlled file_path and does not apply the path restriction added for the earlier download... |
| September 22, 2026 | CVE-2026-77261 | MCP Atlassian | High 7.1 (v3.1) | Prior to 0.22.0, _make_ssrf_safe_hook is omitted from JiraFetcher and ConfluenceFetcher sessions created through the basic-auth and oauth_pat branches. If an... |
| September 22, 2026 | CVE-2026-77260 | MCP Atlassian | High 8.3 (v4.0) | Prior to 0.22.0, the Confluence and Jira upload_attachment implementations accept an unconstrained file_path and open the referenced server-local file. A... |
| September 22, 2026 | CVE-2026-77259 | MCP Atlassian | High 7.7 (v3.1) | Prior to 0.22.0, confluence_upload_attachment opens a caller-selected server-local file without checking that the resolved path remains in the workspace. A... |
| September 22, 2026 | CVE-2026-77258 | MCP Atlassian | High 7.7 (v3.1) | Prior to 0.22.0, upload_attachment in src/mcp_atlassian/confluence/attachments.py accepts a caller-controlled file_path and opens the selected server-local... |
| September 22, 2026 | CVE-2026-77257 | MCP Atlassian | High 8.3 (v4.0) | Prior to 0.22.0, HTTP-exposed Jira and Confluence upload tools pass a caller-provided file_path to local file operations without restricting it to the... |
| September 22, 2026 | CVE-2026-77256 | MCP Atlassian | High 8.3 (v4.0) | Prior to 0.22.0, the plaintext OAuth fallback file containing refresh and access tokens is written with permissions inherited from the process umask. Under... |
| September 22, 2026 | CVE-2026-77255 | MCP Atlassian | High 8.6 (v3.1) | Prior to 0.22.0, the Jira update_issue attachments argument is converted into local paths and routed to the attachment upload implementation without workspace... |
| September 22, 2026 | CVE-2026-77254 | MCP Atlassian | Critical 9.1 (v3.1) | Prior to 0.22.0, requests to the HTTP MCP endpoint without a per-user identity are allowed to reach tool handlers, which then use globally configured Jira or... |
| September 22, 2026 | CVE-2026-77253 | MCP Atlassian | High 7.1 (v3.1) | Prior to 0.22.0, Jira and Confluence attachment upload tools accept arbitrary local filesystem paths and send the selected bytes to Atlassian. In HTTP or... |
| September 22, 2026 | CVE-2026-77252 | MCP Atlassian | Medium 6.5 (v3.1) | Prior to 0.22.0, caller-supplied projects_filter and spaces_filter arguments can replace administrator-configured allowlists, and caller-provided project or... |
| September 22, 2026 | CVE-2026-77251 | MCP Atlassian | High 8.3 (v4.0) | Prior to 0.22.0, Jira search accepts a forbidden project clause because it checks only for the presence of project syntax, Confluence search uses an... |
| September 22, 2026 | CVE-2026-77250 | MCP Atlassian | Medium 6.1 (v3.1) | Prior to 0.22.0, OAuthConfig writes a plaintext fallback file containing access and refresh tokens under the user's .mcp-atlassian directory using... |
| September 22, 2026 | CVE-2026-77249 | MCP Atlassian | Medium 5.3 (v3.1) | Prior to 0.22.0, JiraUserMixin._lookup_user_by_permissions uses the module-level requests.get function instead of the fetcher's protected session. A... |
| September 22, 2026 | CVE-2026-77248 | MCP Atlassian | High 8.6 (v3.1) | Prior to 0.22.0, the streamable HTTP transport accepts requests without a user identity and falls back to operator credentials, while upload_attachment... |
| September 22, 2026 | CVE-2026-77247 | MCP Atlassian | High 8.3 (v4.0) | Prior to 0.22.0, Jira and Confluence upload tools interpret caller-controlled path arguments on the MCP server and open those files before sending them as... |
| September 22, 2026 | CVE-2026-77246 | MCP Atlassian | High 7.4 (v3.1) | Prior to 0.22.0, an HTTP transport deployment with READ_ONLY_MODE=false accepts a request without an Authorization identity and permits attacker-controlled... |
| September 22, 2026 | CVE-2026-77244 | MCP Atlassian | Critical 10.0 (v3.1) | Prior to 0.22.0, the HTTP transport accepts requests without a verified user identity and downstream fetcher construction falls back to the operator's... |
| September 22, 2026 | CVE-2026-77243 | MCP Atlassian | High 8.8 (v3.1) | Prior to 0.22.0, ENABLED_TOOLS and TOOLSETS are applied when tools are listed but are not rechecked when a tools/call request is dispatched. A client that... |
| September 22, 2026 | CVE-2026-77242 | MCP Atlassian | High 7.5 (v3.1) | Prior to 0.22.0, validate_url_for_ssrf checks a hostname's resolved addresses, but Requests and urllib3 resolve the hostname again when connecting. A caller... |
| September 19, 2026 | CVE-2026-93982 | OpenPanel | Low 3.3 | OpenPanel through commit bad75bdd writes Model Context Protocol authentication tokens from URL query parameters to plaintext application logs without redaction. Attackers with access to application stdout or centralized logging systems can capture... |
| September 18, 2026 | CVE-2026-58197 | ToolHive | High 8.8 | Prior to ToolHive CLI 0.30.1 and ToolHive Studio 0.38.0, locally run MCP server containers use the default network permission profile without network... |
| September 17, 2026 | CVE-2026-50125 | MKP | High 7.5 | Prior to 0.4.1, cmd/server/main.go exposes the default HTTP endpoint and pkg/mcp/server.go registers the unauthenticated get_resource tool, which accepts attacker-controlled limitBytes and tailLines... |
| September 16, 2026 | CVE-2026-64684 | RMCP | Medium 6.8 | Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamable_http_client.rs builds its default_http_client with reqwest's automatic redirect... |
| September 16, 2026 | CVE-2026-63128 | RMCP | High 7.5 | Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/streamable_http_server/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST... |
| September 16, 2026 | CVE-2026-63127 | RMCP | High 8.2 | Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows... |
| September 15, 2026 | CVE-2026-61568 | @zereight/mcp-gitlab | Critical 9.6 | Versions prior to 2.1.30 expose the Streamable HTTP MCP endpoint without an effective Host or Origin allowlist. A malicious web page can use DNS rebinding to route browser requests to a... |
| September 15, 2026 | CVE-2026-61560 | @zereight/mcp-gitlab | Critical 9.8 | Prior to version 2.1.27, the SSE transport mode (`SSE=true`) exposes all MCP tools without any authentication. The `upload_markdown` tool reads arbitrary files from the server's local... |
| September 15, 2026 | CVE-2026-61559 | @zereight/mcp-gitlab | Critical 9.6 | Starting in version 0.0.1 and prior to version 2.1.27, when the environment variable `ENABLE_DYNAMIC_API_URL=true` is set, the server reads the `X-GitLab-API-URL` HTTP request header and... |
| September 15, 2026 | CVE-2026-59973 | FrontMCP | High 8.5 | From mcp-from-openapi 2.3.0 until 2.5.0 and from frontmcp and @frontmcp/adapters 1.2.1 until 1.5.0, libs/adapters/src/openapi/openapi.adapter.ts loadOpenAPISpec() forwards... |
| September 15, 2026 | CVE-2026-59971 | MySQL MCP Server | Critical 10.0 | Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/mysql_mcp_server/server.py to construct SseServerTransport without security_settings or... |
| September 15, 2026 | CVE-2026-58485 | mcp-searxng | High 7.1 | Prior to 1.7.1, web_url_read receives its caller-controlled URL through src/index.ts and validates only the literal hostname in... |
| September 15, 2026 | CVE-2026-58483 | mcp-searxng | High 7.5 | Prior to 1.7.1, web_url_read in src/index.ts passes a caller-supplied URL to readUrlContent() in src/url-reader.ts, where... |
| September 15, 2026 | CVE-2026-58201 | Lokka | High 8.7 | Prior to 2.1.2, the Lokka-Microsoft tool in src/mcp/src/main.ts uses direct URL string concatenation to append the user-controlled path value to the... |
| September 15, 2026 | CVE-2026-58196 | ToolHive | Medium 4.7 | Prior to 0.31.0, remote.Handler.Authenticate in pkg/auth/remote/handler.go invokes discovery.DetectAuthenticationFromServer in... |
| September 15, 2026 | CVE-2026-57442 | MCPVault | Medium 6.9 | Prior to 0.11.5, PathFilter in src/pathfilter.ts uses root-anchored deny-list patterns, so nested .git, .obsidian, and node_modules path segments do not... |
| September 15, 2026 | CVE-2026-57441 | MCPVault | High 8.4 | Prior to 0.11.4, PathFilter in src/pathfilter.ts compiles restricted-directory patterns case-sensitively and compares paths without canonicalizing... |
| September 15, 2026 | CVE-2026-54689 | mcp-searxng | Medium 6.3 | Prior to 1.2.0, the web_url_read URL policy in src/url-reader.ts can be bypassed while MCP_HTTP_HARDEN is enabled and... |
| September 15, 2026 | CVE-2026-54688 | mcp-searxng | Medium 6.5 | Prior to 1.2.0, web_url_read passes a caller-supplied URL to the server-side fetch path while assertUrlAllowed() in... |
| September 15, 2026 | CVE-2026-54549 | Meta Ads MCP | High 8.3 | Prior to version 1.0.115, the upload_ad_image tool in meta_ads_mcp/core/ads.py passes an attacker-controlled image_url to try_multiple_download_methods() in... |
| September 15, 2026 | CVE-2026-54547 | Meta Ads MCP | High 7.4 | Prior to version 1.0.115, AuthInjectionMiddleware in meta_ads_mcp/core/http_auth_integration.py rejects HTTP MCP requests only when both auth_token and pipeboard_token... |
| September 15, 2026 | CVE-2026-54450 | ToolHive | Low 2.9 | Prior to 0.29.1, networking.IsPrivateIP in pkg/networking/utilities.go omits the IPv6 NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48, so NAT64... |
| September 15, 2026 | CVE-2026-53957 | Contentful MCP Server | High 7.7 | Prior to @contentful/mcp-server 1.7.19 and @contentful/mcp-tools 0.4.5, export_space and import_space in... |
| September 14, 2026 | CVE-2026-73497 | MCP Atlassian | Medium 6.5 | From 0.17.0 until 0.22.0, validate_url_for_ssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at... |
| September 14, 2026 | CVE-2026-73496 | MCP Atlassian | High 7.7 | Prior to 0.22.0, the confluence_upload_attachment and confluence_upload_attachments tools pass a client-controlled file_path through... |
| September 14, 2026 | CVE-2026-55837 | dbt-mcp | Medium 6.8 | Prior to 1.20.0, the local OAuth helper in src/dbt_mcp/oauth/fastapi_app.py exposes GET /dbt_platform_context without authentication or Host validation after a user completes the dbt... |
| September 9, 2026 | CVE-2026-53937 | MCP Kotlin SDK | Medium 6.2 | In versions 0.7.0 through 0.12.0, `ReadBuffer.append` in `kotlin-sdk-core/src/commonMain/kotlin/io/modelcontextprotocol/kotlin/sdk/shared/ReadBuffer.kt` writes... |
| September 4, 2026 | CVE-2026-85674 | aider | High 7.8 | aider (aider-chat) automatically loads a .aider.conf.yml configuration file from the root of the git repository it is launched in. A crafted repository can set test-cmd (executed at startup) or lint-cmd (executed on the first file edit), which aider runs... |
| August 28, 2026 | CVE-2026-81835 | RooCodeInc Roo-Code | Medium 5.5 | A security vulnerability has been detected in RooCodeInc Roo-Code up to 3.51.1. This affects the function fetch_instructions of the file malicious_mcp_server.py of the component MCP Integration Trust Model. The manipulation leads to code injection. The... |
| August 27, 2026 | CVE-2026-37006 | gpt-researcher | Critical 9.8 | A vulnerability in the WebSocket endpoint of gpt-researcher v0.14.7 and before allows an unauthenticated remote attacker to achieve code execution via malicious Model Context Protocol configurations. |
| August 25, 2026 | CVE-2026-53965 | MCP PHP SDK | Medium 6.9 | In versions 0.5.0 through 0.7.0, the HTTP client transport reads a Server-Sent Events response stream incrementally and appends each chunk to an in-memory buffer... |
| August 14, 2026 | CVE-2026-49986 | Cortex | High 7.1 | The Cortex MCP server (`neuro-cortex-memory`), a cross-platform persistent memory MCP, prior to version 3.17.1 treats the `CLAUDE_PROJECT_DIR` environment variable — automatically set by Claude Code to the currently open project directory — as a trusted... |
| August 13, 2026 | CVE-2026-73614 | Network-AI ClaudeHookBridge | High 8.8 | Network-AI ClaudeHookBridge before 5.15.1 truncates the target string to 500 characters before evaluating denyPatterns, while Claude Code executes the full untruncated command. Attackers can position dangerous content past byte 500 in a Bash command field... |
| August 13, 2026 | CVE-2026-19753 | Model Context Protocol mcp-rdf-explorer | High 7.3 | A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side... |
| August 12, 2026 | CVE-2026-73498 | MCP Atlassian | High 7.7 | Prior to 0.22.0, confluence_upload_attachment passes its client-supplied file_path directly to open(file_path, "rb") in... |
| August 11, 2026 | CVE-2026-73222 | Claude Code Templates | High 8.8 | Prior to 1.29.4, the Claude Code Studio server launched by the --studio option in cli-tool/src/sandbox-server.js binds to all interfaces on port 3444, permits cross-origin... |
| August 11, 2026 | CVE-2026-73218 | Cursor | High 7.7 | Prior to 3.0.0, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode, when Docker Desktop and the Dev Containers CLI are installed, to launch a privileged container and mount Docker's... |
| August 11, 2026 | CVE-2026-73217 | Cursor | High 7.7 | Prior to 3.1.2, Cursor IDE for macOS allows an agent running in Auto-Run Sandbox mode to replace a virtual environment's Python executable with a malicious wrapper that the Microsoft Python extension... |
| August 7, 2026 | CVE-2026-48039 | Meta Ads MCP | Critical 9.1 | Prior to version 1.0.109, `AuthInjectionMiddleware.dispatch()` at `http_auth_integration.py:272` unconditionally forwards unauthenticated Streamable HTTP requests to... |
| August 6, 2026 | CVE-2026-67531 | FrontMCP | Critical 9.3 | Prior to 1.5.7, the sandboxed codecall:execute tool exposes live host Zod schema instances to the script via getTool(), and because Zod v4 defines _zod as a non-configurable,... |
| August 5, 2026 | CVE-2026-8446 | IBM Langflow OSS | High 7.5 | IBM Langflow OSS 1.0.0 through 1.10.3 contain an authentication bypass vulnerability in the Model Context Protocol (MCP) composer endpoint when mcp_composer_enabled=true (default) and projects are configured with auth_type=oauth . |
| July 29, 2026 | CVE-2026-67432 | MCP Ruby SDK | High 7.5 | Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an... |
| July 29, 2026 | CVE-2026-67431 | MCP Ruby SDK | High 8.3 | Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with a stolen session ID... |
| July 29, 2026 | CVE-2026-67430 | MCP Ruby SDK | Medium 5.3 | Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded... |
| July 29, 2026 | CVE-2026-63119 | MCP Ruby SDK | Medium 6.2 | Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client::Stdio in the mcp gem use IO#gets without a byte limit, allowing a peer that sends data without a... |
| July 29, 2026 | CVE-2026-63118 | MCP Ruby SDK | Medium 6.9 | Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser... |
| July 22, 2026 | CVE-2026-44192 | Ansible Lightspeed MCP server | Medium 6.6 | A flaw was found in the Ansible Lightspeed Model Context Protocol (MCP) server. This vulnerability, known as path traversal, allows an attacker to manipulate an AI agent through indirect prompt injection. By doing so, the attacker can cause the server to... |
| July 20, 2026 | CVE-2026-57495 | AgenticMail | High 8.2 | AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/claudecode prior to version 0.2.39, @agenticmail/codex prior to version 0.1.33, @agenticmail/core prior to version 0.9.43, and @agenticmail/openclaw prior to version 0.5.71,... |
| July 20, 2026 | CVE-2026-46555 | WhatsApp MCP Server | High 7.1 | Prior to version 0.2.1, the `whatsapp-bridge` HTTP API listens on `127.0.0.1:8080` without authentication and without Host header... |
| July 17, 2026 | CVE-2026-63093 | Cursor for Windows | High 8.8 | Cursor for Windows version 3.2.16 contains a binary planting vulnerability that allows remote attackers to achieve arbitrary code execution by placing a malicious git.exe file in the repository root directory. When a developer clones and opens a crafted... |
| July 16, 2026 | CVE-2026-47751 | Claude Code Action | Medium 5.3 | Prior to 1.0.74, because the action checked out attacker-controlled pull request head branches, read .mcp.json from the working directory via... |
| July 16, 2026 | CVE-2026-44970 | dbt-mcp | Medium 4.3 | Prior to 1.17.1, DefaultUsageTracker.emit_tool_called_event() in src/dbt_mcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through... |
| July 16, 2026 | CVE-2026-44969 | dbt-mcp | Low 3.3 | Prior to 1.17.1, DbtMCP.call_tool() in src/dbt_mcp/mcp/server.py logged the raw arguments dictionary at INFO level before each tool call and at ERROR level on exceptions, and... |
| July 16, 2026 | CVE-2026-44968 | dbt-mcp | Medium 6.3 | Prior to 1.17.1, _run_dbt_command() in src/dbt_mcp/dbt_cli/tools.py appended unsanitized node_selection and resource_type values to the dbt subprocess argument list, allowing an MCP client... |
| July 15, 2026 | CVE-2026-61613 | Cursor | High 7.7 | Prior to the Cloud Agent fix on 03/31/2026, browser-enabled Cursor Cloud Agent sessions allowed attacker-controlled web content to connect from inside the agent container to an unauthenticated local agent... |
| July 15, 2026 | CVE-2026-59950 | MCP Python SDK | High 8.1 | Prior to 1.28.1, the deprecated mcp.server.websocket.websocket_server transport accepted WebSocket handshakes without applying Host or Origin header... |
| July 15, 2026 | CVE-2026-52870 | MCP Python SDK | High 7.6 | From 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel... |
| July 15, 2026 | CVE-2026-52869 | MCP Python SDK | High 7.1 | Prior to 1.27.2, the SSE and stateful Streamable HTTP transports mcp.server.sse.SseServerTransport and... |
| July 14, 2026 | CVE-2026-15643 | AWS HealthLake MCP Server | High 7.3 | AWS HealthLake MCP Server (awslabs.healthlake-mcp-server) is a Model Context Protocol server that enables AI assistants to interact with AWS HealthLake FHIR datastores. A server-side request forgery in the pagination handling component in AWS... |
| July 9, 2026 | CVE-2026-59726 | Ruflo | Critical 10.0 | Prior to 3.16.3, ruflo's default docker-compose deployment exposed the MCP bridge POST /mcp and POST /mcp/:group endpoints without authentication, allowing an unauthenticated network attacker to invoke... |
| July 8, 2026 | CVE-2026-59822 | BerriAI LiteLLM | High 8.2 | BerriAI LiteLLM contains an improper authentication vulnerability in the MCP Streamable HTTP endpoint that could... |
| July 8, 2026 | CVE-2026-59723 | Cline | High 8.8 | Prior to 3.0.30, the Cline Hub dashboard server launched by the cline dashboard command accepts WebSocket connections on the /browser endpoint without validating the Origin... |
| July 3, 2026 | CVE-2026-13341 | Kong Konnect MCP Server | High 7.4 | A vulnerability exists in the Kong Konnect Model Context Protocol (MCP) server prior to version 1.0.0, which could allow a remote attacker to perform an indirect prompt injection attack and execute unintended API requests. |
| July 1, 2026 | CVE-2026-13323 | Open VSX Registry | High 8.7 | In Open VSX Registry before 1.0.2, the /vscode/unpkg/ endpoint serves user-supplied HTML files with Content-Type: text/html and without a Content-Security-Policy or Content-Disposition: attachment response header. An unauthenticated attacker can register a... |
| June 29, 2026 | CVE-2026-55607 | Claude Code | High 8.8 | From 2.1.38 until 2.1.163, Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox context, enabling git directory confusion attacks. By exploiting... |
| June 29, 2026 | CVE-2026-46406 | Claude Code | Medium 6.1 | From 2.1.59 until 2.1.128, the Claude Code /copy command wrote responses to a hardcoded, predictable path (/tmp/claude/response.md) without UID isolation, randomness, or symlink protection. The file was created... |
| June 25, 2026 | CVE-2026-50549 | Cursor | Critical 9.8 | Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default. Before a Write, the agent canonicalizes the target path to confirm it stays inside the workspace, but when canonicalization fails... |
| June 25, 2026 | CVE-2026-50548 | Cursor | Critical 9.8 | Prior to 3.0, Cursor runs agent terminal commands in a sandbox by default, and the sandbox grants write access to the command's working directory. A flaw was identified in how the agent could modify the... |
| June 23, 2026 | CVE-2026-54316 | Claude Code | Critical 9.1 | From 0.2.54 until 2.1.163, because the hostname huggingface.co was pre-approved as a bare hostname for the WebFetch tool, any path on that domain—including attacker-controlled model repositories—was auto-approved without... |
| June 22, 2026 | CVE-2025-66389 | GitHub Copilot | High 7.5 | GitHub Copilot 1.372.0 allows filesystem access outside of a workspace folder (without user approval) via a file-handler URI parameter to fetch_webpage. Therefore, exfiltration could occur if there is indirect prompt injection. |
| June 18, 2026 | CVE-2026-49257 | mcp-pinot | Critical 10.0 | In versions 3.0.1 and below, mcp-pinot defaults to running an HTTP MCP server bound to 0.0.0.0:8080 with no authentication enabled. All MCP tools, including SQL... |
| June 15, 2026 | CVE-2026-48124 | Cursor | High 8.5 | In versions prior to 3.0.0, the Cursor Desktop could execute workspace-defined Claude hook commands from .claude/settings.local.json without dedicated user approval. A malicious workspace or agent-created... |
| June 13, 2026 | CVE-2026-11624 | Google MCP Toolbox for Databases | Critical 9.4 | The Model Context Protocol has a security warning advising servers to validate the "Origin" header on all incoming connections to prevent DNS rebinding attacks. Prior to the v0.25.0 release, users had no way to validate the origin's host. In v0.25.0, a new... |
| June 11, 2026 | CVE-2026-47250 | mcp-server-kubernetes | Medium 6.1 | Prior to version 3.7.0, the kubectl_generic tool in mcp-server-kubernetes passes user-supplied flags directly to kubectl without any allowlist, enabling a privilege... |
| June 11, 2026 | CVE-2026-46519 | mcp-server-kubernetes | High 8.8 | Prior to version 3.6.0, mcp-server-kubernetes exposes three environment variables (ALLOW_ONLY_READONLY_TOOLS, ALLOW_ONLY_NON_DESTRUCTIVE_TOOLS, ALLOWED_TOOLS)... |
| June 2, 2026 | CVE-2026-32625 | LibreChat | Critical 9.6 | In versions up to and including 0.8.3, the Model Context Protocol (MCP) server integration resolves ${VAR} placeholders against the server's process.env during Zod schema validation... |
| June 1, 2026 | CVE-2026-44211 | Cline | Critical 9.6 | In versions 2.13.0 and prior, there is a cross-origin WebSocket hijack vulnerability in Cline Kanban servers. At time of publication, there are no publicly available patches. |
| May 31, 2026 | CVE-2026-10177 | Aider-AI Aider | Medium 6.3 | A security vulnerability has been detected in Aider-AI Aider 0.86.3. This affects the function requests.get of the file api_docs.py of the component AWS EC2 Metadata Endpoint. The manipulation leads to server-side request forgery. The attack is possible to... |
| May 31, 2026 | CVE-2026-10176 | Aider-AI Aider | Medium 6.3 | A weakness has been identified in Aider-AI Aider 0.86.3. Affected by this issue is some unknown functionality of the component Code Generation Workflow. Executing a manipulation can lead to sql injection. The attack can be executed remotely. The exploit has... |
| May 31, 2026 | CVE-2026-10175 | Aider-AI Aider | Medium 6.3 | A security flaw has been discovered in Aider-AI Aider 0.86.3. Affected by this vulnerability is the function editor_coder.run of the file auth.py of the component Architect Mode. Performing a manipulation results in code injection. Remote exploitation of... |
| May 31, 2026 | CVE-2026-10174 | Aider-AI Aider | Medium 6.3 | A vulnerability was identified in Aider-AI Aider 0.86.3. Affected is an unknown function of the file aider/args.py of the component Pre-commit Hook Handler. Such manipulation of the argument git-commit-verify leads to protection mechanism failure. The... |
| May 29, 2026 | CVE-2026-45609 | mcp-security | Medium 6.5 | mcp-security provides Security and Authorization support for Model Context Protocol in Spring AI. Prior to 0.1.9, the mcp-security framework fails to implement the mandatory SSRF mitigations outlined in the Model Context Protocol (MCP) security... |
| May 28, 2026 | CVE-2026-44466 | Zed | High 8.6 | Prior to 0.229.0, Zed's terminal tool permission system can be bypassed via bash arithmetic expansion $((...)), allowing execution of arbitrary commands nested inside an allowlisted command like echo. This vulnerability is fixed in... |
| May 28, 2026 | CVE-2026-44465 | Zed | High 8.6 | Prior to 0.227.1, Zed IDE executes arbitrary commands when opening a folder with a malicious .git/config file that abuses the core.fsmonitor Git configuration option. This allows an attacker to achieve Remote Code Execution (RCE) when a... |
| May 28, 2026 | CVE-2026-44463 | Zed | High 7.8 | Prior to 0.229.0, Zed's terminal tool permission system can be bypassed by prepending environment variable assignments to allowlisted commands, hijacking program behavior (e.g., PAGER) to execute arbitrary code. This vulnerability is... |
| May 28, 2026 | CVE-2026-44462 | Zed | High 8.8 | Prior to 0.229.0, Zed's terminal tool permission system can be bypassed via bash variable expansion chaining (${var@P}), allowing arbitrary command execution under an allowlisted command prefix. This vulnerability is fixed in 0.229.0. |
| May 28, 2026 | CVE-2026-44461 | Zed | High 8.6 | Prior to 0.227.1, Zed builds SSH/WSL remote commands as a shell command string that starts with exec env ..., but environment variable keys are inserted without shell quoting or validation. If an attacker can control an environment... |
| May 25, 2026 | CVE-2026-9468 | dazeb cline-mcp-memory-bank | Medium 6.3 | A security flaw has been discovered in dazeb cline-mcp-memory-bank up to 55c81b9cf6c16700983c84dc4cdea3cafa19a75f. The affected element is the function handleInitializeMemoryBank of the file src/index.ts. The manipulation of the argument projectPath results... |
No disclosures match that filter.